Keep root RuboCop bundle lint-only (#3841)

## Summary

Closes #3837.

- Keep the root Gemfile focused on repo-wide RuboCop, hook, release, and
benchmark script tooling instead of evaluating the OSS package Gemfile.
- Delegate package Rake tasks from the monorepo root through the
`react_on_rails` bundle so root callers keep working without
contaminating package locks.
- Update setup/CI helpers and contributor docs so each command selects
the intended Gemfile explicitly.

## Validation

- `bundle install`
- `bundle exec rake lint`
- `(cd react_on_rails && bundle exec rake lint:rubocop)` with
package/root lockfile hashes unchanged
- `bundle exec rubocop Rakefile Gemfile rakelib/release.rake
react_on_rails/rakelib/lint.rake`
- `bundle exec ruby -c Rakefile`
- `ruby -c rakelib/release.rake`
- `ruby -c react_on_rails/rakelib/lint.rake`
- `bundle exec rspec benchmarks/spec`
- `zsh -n conductor-setup.sh`
- `bash -n bin/ci-local bin/ci-rerun-failures bin/setup`
- `shellcheck bin/ci-rerun-failures bin/ci-local bin/setup`
- `pnpm exec prettier --check AGENTS.md .github/dependabot.yml`
- `bundle exec bin/setup --help`
- `bundle exec rake node_package`
- `(cd react_on_rails && bundle exec rake rbs:validate)`
- `(cd react_on_rails && bundle check)`
- `(cd react_on_rails && BUNDLE_GEMFILE="$PWD/Gemfile" bundle exec rspec
spec/react_on_rails/ruby_version_support_spec.rb)`
- `(cd react_on_rails && BUNDLE_GEMFILE=../Gemfile bundle exec rubocop
--format simple --cache false -- Rakefile ../Rakefile
../rakelib/release.rake)`
- `codex review --base origin/main`
- `git diff --check`

Full CI and benchmark are requested because this changes root/package
Rake delegation and setup/CI bundle selection.

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Medium Risk**
> Touches root vs package bundle boundaries, Rake delegation, and local
CI/setup scripts; wrong Gemfile selection could break contributor
workflows, but runtime gem behavior is unchanged.
> 
> **Overview**
> **Splits the monorepo root Ruby bundle from the OSS gem** so `bundle
install` at the repo root only pulls lint, hooks, release, and
benchmark-spec tooling (RuboCop, Rake, RSpec, lefthook, etc.), instead
of evaluating `react_on_rails/Gemfile` and dragging in Rails and the
full test stack. `Gemfile.lock` shrinks accordingly; Dependabot’s
bundler config now includes `/` for that lock.
> 
> **Root `rake` still works via delegation**: the root `Rakefile` no
longer loads the package Rakefile; it runs common tasks (`lint`,
`run_rspec:*`, `shakapacker_examples:*`, `node_package`, etc.) inside
`react_on_rails` with `bundle exec`, auto-installing that bundle when
needed. Root `rake lint` is root-tooling RuboCop only; full package lint
stays `cd react_on_rails && bundle exec rake lint`.
> 
> **Contributor and CI scripts** (`AGENTS.md`, `bin/setup`,
`bin/ci-local`, `bin/ci-rerun-failures`, `conductor-setup.sh`) now
install and invoke the correct Gemfile per directory via a shared
`bundle_command` helper. Package lint still invokes root RuboCop through
`BUNDLE_GEMFILE=../Gemfile` with `Bundler.with_unbundled_env`.
> 
> **Release rake** drops the `ReactOnRails::Utils` require and uses a
local `release_truthy?` for dry-run/override flags.
> 
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
8299358. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Chores**
* Centralized Bundler/Gemfile handling across the repo, CI, and setup
scripts to ensure correct dependency installation and selection.
* Improved dependency bootstrapping order and environment isolation for
OSS and Pro flows.
  * Unified truthiness parsing for release tooling.

* **Documentation**
* Clarified workflow and setup commands to consistently scope
package-specific bundle and task invocations.

* **Refactor**
* Reworked root-level task delegation and lint/test wrappers for
clearer, safer task execution.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

## Agent Merge Confidence

Mode: accelerated-rc
Score: 9/10
Auto-merge recommendation: yes
Affected areas: root/OSS bundle separation, RuboCop lint routing,
setup/CI scripts, Dependabot config.
Checks: current head `82993589292d0d9bd6e9fa0246eb22213b42f763` has 49
passing checks and 5 expected selector-skipped checks; full CI and
benchmark labels are present and exercised.
Review threads: 0 unresolved current review threads.
Known residual risk: root bundle/package boundary touches setup and CI
helper routing; mitigated by local shell/Rake/RuboCop/lint validations,
full CI and benchmark pass, and current-head AI review checks.
Finalized by: Claude Code Review check `claude-review` for current head
`82993589292d0d9bd6e9fa0246eb22213b42f763` (SUCCESS).

Author: justin808

.github/dependabot.yml

@@ -62,10 +62,10 @@ updates:
           - "shakapacker"
     multi-ecosystem-group: "execjs-dummy-shakapacker"
 
-  # Ruby gems - Open source and Pro gems (including dummy apps)
-  # Root directory is not included because it reuses the Gemfile from react_on_rails
+  # Ruby gems - root tooling plus Open source and Pro gems (including dummy apps)
   - package-ecosystem: "bundler"
     directories:
+      - "/"
       - "/react_on_rails"
       - "/react_on_rails/spec/dummy"
       - "/react_on_rails_pro"

AGENTS.md

@@ -39,10 +39,12 @@ If there is a conflict, `AGENTS.md` wins.
 # Install dependencies
 # The committed root Gemfile.lock is generated with Bundler 4.0.10; use Bundler
 # 4.0.10 or newer before running root bundle commands.
-bundle && pnpm install
+bundle && (cd react_on_rails && bundle) && pnpm install
 
-# After changing react_on_rails/Gemfile or Gemfile.shared_dev_dependencies,
-# also run bundle install at the repo root to keep the root Gemfile.lock synced.
+# The root Gemfile is intentionally limited to repo-wide lint, hook, release,
+# and benchmark script spec tooling. After changing package Gemfiles, run bundle
+# install in that package directory; after changing the root Gemfile, run bundle
+# install at the repo root to sync the tooling lock.
 
 # Build TypeScript → JavaScript
 pnpm run build
@@ -53,35 +55,36 @@ pnpm run build
 (cd react_on_rails_pro && BUNDLE_GEMFILE=../Gemfile bundle exec rubocop --ignore-parent-exclusion)
 pnpm run lint                                                    # JS/TS via ESLint
 pnpm start format.listDifferent                                  # Check Prettier formatting
-rake lint                                                        # All linting (Ruby + JS + formatting)
+(cd react_on_rails && bundle exec rake lint)                     # Package lint task (Ruby + JS + formatting)
 
 # Optional Ruby diagnostic from the repo root (not the CI contract)
 BUNDLE_GEMFILE=Gemfile bundle exec rubocop
 
 # Auto-fix formatting
-rake autofix                         # Preferred for all formatting
+(cd react_on_rails && bundle exec rake autofix) # Preferred for all formatting
 
 # Run tests
-rake run_rspec:gem                   # Ruby unit tests (gem code)
-rake run_rspec:dummy                 # Ruby integration tests (dummy Rails app)
+(cd react_on_rails && bundle exec rake run_rspec:gem)   # Ruby unit tests (gem code)
+(cd react_on_rails && bundle exec rake run_rspec:dummy) # Ruby integration tests (dummy Rails app)
 pnpm run test                        # JavaScript/TypeScript tests
-rake                                 # Full suite (lint + all tests except examples)
+(cd react_on_rails && bundle exec rake)                 # Full package suite (lint + tests except examples)
 
 # Type checking
 pnpm run type-check                  # TypeScript
-bundle exec rake rbs:validate        # RBS signatures
+(cd react_on_rails && bundle exec rake rbs:validate) # RBS signatures
 
 # Additional test subsets
-rake run_rspec                       # All Ruby tests
-rake all_but_examples                # All tests except generated examples
-rake run_rspec:shakapacker_examples_basic  # Single example test
+(cd react_on_rails && bundle exec rake run_rspec) # All Ruby tests
+(cd react_on_rails && bundle exec rake all_but_examples) # All tests except generated examples
+(cd react_on_rails && bundle exec rake run_rspec:shakapacker_examples_basic) # Single example test
 
 # Documentation checks
 script/check-docs-sidebar            # Validate docs sidebar coverage
 bin/check-links                      # Markdown link checks (requires lychee)
 
 # Full initial setup
-bundle && pnpm install && rake shakapacker_examples:gen_all && rake node_package && rake
+bundle && (cd react_on_rails && bundle) && pnpm install && \
+  (cd react_on_rails && bundle exec rake shakapacker_examples:gen_all node_package && bundle exec rake)
 
 # CI/workflow linting
 actionlint                           # GitHub Actions lint

Gemfile

@@ -1,12 +1,16 @@
 # frozen_string_literal: true
 
-# Root Gemfile for developer convenience and RuboCop tooling.
-# RuboCop is owned here so the monorepo uses one locked version.
-
-# Use the open-source gem's Gemfile
-eval_gemfile File.expand_path("react_on_rails/Gemfile", __dir__)
+source "https://rubygems.org"
 
+# Root Gemfile for repo-wide lint, hook, release, and benchmark script spec tooling only.
+# Package/runtime dependencies stay in the package Gemfiles so root bundle install
+# remains small.
 group :development, :test do
+  gem "benchmark", "0.5.0", require: false
+  gem "gem-release", "2.2.4", require: false
+  gem "lefthook", "2.1.9", require: false
+  gem "rake", "13.4.2", require: false
+  gem "rspec", "3.13.2", require: false
   gem "rubocop", "1.61.0", require: false
   gem "rubocop-performance", "1.20.2", require: false
   gem "rubocop-rspec", "2.31.0", require: false