Add bundler-cache input to setup action

Lets consumers run `bundle install` (with caching) during the setup
step. Needed when their `base-secrets-file` shells out to `bin/rails
credentials:fetch` (or any other `bundle exec` command), since Kamal
evaluates the secrets file on the runner before deploying. Threaded
through the composite action, reusable workflows, and the sweep
variants. Default `false`.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: jmschneider

.github/actions/setup/action.yml

@@ -16,6 +16,15 @@ inputs:
   ssh-private-key:
     description: Private key registered with the deploy host. Loaded into ssh-agent.
     required: true
+  bundler-cache:
+    description: |
+      When `true`, run `bundle install` (with caching) on the runner.
+      Needed when your `base-secrets-file` shells out to `bin/rails
+      credentials:fetch` (or any other `bundle exec` command) — Kamal
+      evaluates the secrets file on the runner before deploying, so the
+      runner needs the gem set installed. Default `false`.
+    required: false
+    default: "false"
   setup-buildx:
     description: Whether to install Docker Buildx (needed for `kamal build`).
     required: false
@@ -44,7 +53,7 @@ runs:
       uses: ruby/setup-ruby@v1
       with:
         ruby-version: ${{ inputs.ruby-version }}
-        bundler-cache: false
+        bundler-cache: ${{ inputs.bundler-cache }}
 
     - name: Install Kamal
       shell: bash

.github/workflows/preview.yml

@@ -96,6 +96,10 @@ on:
         default: 0
       ruby-version:            { type: string, default: "3.3" }
       kamal-version:           { type: string, default: "" }
+      bundler-cache:
+        description: Run `bundle install` (with caching) on the runner. Needed when `base-secrets-file` shells out to `bin/rails credentials:fetch`.
+        type: string
+        default: "false"
       ssh-user:                { type: string, default: deploy }
       ssh-port:                { type: string, default: "22" }
 
@@ -188,6 +192,7 @@ jobs:
         with:
           ruby-version: ${{ inputs.ruby-version }}
           kamal-version: ${{ inputs.kamal-version }}
+          bundler-cache: ${{ inputs.bundler-cache }}
           ssh-private-key: ${{ secrets.SSH_PRIVATE_KEY }}
           registry-username: ${{ secrets.KAMAL_REGISTRY_USERNAME }}
           registry-password: ${{ secrets.KAMAL_REGISTRY_PASSWORD }}
@@ -385,6 +390,7 @@ $msg" >/dev/null || true
         with:
           ruby-version: ${{ inputs.ruby-version }}
           kamal-version: ${{ inputs.kamal-version }}
+          bundler-cache: ${{ inputs.bundler-cache }}
           ssh-private-key: ${{ secrets.SSH_PRIVATE_KEY }}
           setup-buildx: "false"
           setup-gha-cache: "false"

.github/workflows/sweep.yml

@@ -51,6 +51,10 @@ on:
       prefix-strip:            { type: string, default: "feature/,feat/,fix/,bug/,bugfix/,chore/,hotfix/,release/" }
       ruby-version:            { type: string, default: "3.3" }
       kamal-version:           { type: string, default: "" }
+      bundler-cache:
+        description: Run `bundle install` (with caching) on the runner. Needed when `base-secrets-file` shells out to `bin/rails credentials:fetch`.
+        type: string
+        default: "false"
       ssh-user:                { type: string, default: deploy }
       ssh-port:                { type: string, default: "22" }
       environment-prefix:
@@ -176,6 +180,7 @@ jobs:
         with:
           ruby-version: ${{ inputs.ruby-version }}
           kamal-version: ${{ inputs.kamal-version }}
+          bundler-cache: ${{ inputs.bundler-cache }}
           ssh-private-key: ${{ secrets.SSH_PRIVATE_KEY }}
           setup-buildx: "false"
           setup-gha-cache: "false"

action.yml

@@ -120,6 +120,10 @@ inputs:
 
   ruby-version:               { required: false, default: "3.3" }
   kamal-version:              { required: false, default: "" }
+  bundler-cache:
+    description: When `true`, runs `bundle install` (with caching) during setup. Needed if your `base-secrets-file` shells out to `bin/rails credentials:fetch` (or any other `bundle exec`) at deploy time. Default `false`.
+    required: false
+    default: "false"
   ssh-user:                   { required: false, default: deploy }
   ssh-port:                   { required: false, default: "22" }
 
@@ -225,6 +229,7 @@ runs:
       with:
         ruby-version: ${{ inputs.ruby-version }}
         kamal-version: ${{ inputs.kamal-version }}
+        bundler-cache: ${{ inputs.bundler-cache }}
         ssh-private-key: ${{ env.SSH_PRIVATE_KEY }}
         setup-buildx: ${{ steps.dispatch.outputs.mode == 'deploy' && 'true' || 'false' }}
         setup-gha-cache: ${{ steps.dispatch.outputs.mode == 'deploy' && 'true' || 'false' }}

sweep/action.yml

@@ -57,6 +57,7 @@ inputs:
   prefix-strip:               { required: false, default: "feature/,feat/,fix/,bug/,bugfix/,chore/,hotfix/,release/" }
   ruby-version:               { required: false, default: "3.3" }
   kamal-version:              { required: false, default: "" }
+  bundler-cache:              { required: false, default: "false" }
   ssh-user:                   { required: false, default: deploy }
   ssh-port:                   { required: false, default: "22" }
   environment-prefix:         { required: false, default: "preview-" }
@@ -86,6 +87,7 @@ runs:
       with:
         ruby-version: ${{ inputs.ruby-version }}
         kamal-version: ${{ inputs.kamal-version }}
+        bundler-cache: ${{ inputs.bundler-cache }}
         ssh-private-key: ${{ env.SSH_PRIVATE_KEY }}
         setup-buildx: "false"
         setup-gha-cache: "false"