Release usage_credits 1.0 on the hardened wallets ledger core

.github/workflows/test.yml

@@ -12,6 +12,15 @@ on:
       - "*.md"
       - "LICENSE.txt"
 
+permissions:
+  contents: read
+
+# usage_credits 1.0 depends on wallets 0.3 before that version exists on
+# RubyGems. Every CI lane resolves the exact reviewed Wallets candidate below;
+# remove this source override only after the published dependency is available.
+env:
+  WALLETS_PATH: ${{ github.workspace }}/wallets-core
+
 jobs:
   # Main test suite - tests Ruby versions and Rails/Pay compatibility with SQLite
   sqlite:
@@ -22,47 +31,135 @@ jobs:
       matrix:
         ruby_version: ["3.3", "3.4", "4.0"]
         gemfile:
-          - Gemfile
-          - gemfiles/rails_7.2.gemfile
-          - gemfiles/rails_8.1.gemfile
-          - gemfiles/pay_8.3.gemfile
-          - gemfiles/pay_9.0.gemfile
-          - gemfiles/pay_10.0.gemfile
-          - gemfiles/pay_11.0.gemfile
+          - path: Gemfile
+            label: default
+          - path: gemfiles/rails_7.2.gemfile
+            label: rails-7.2
+          - path: gemfiles/rails_8.1.gemfile
+            label: rails-8.1
+          - path: gemfiles/pay_minimum.gemfile
+            label: pay-minimum
+        include:
+          # Exercise both Rails boundaries on the minimum secure Ruby line.
+          - ruby_version: "3.2"
+            gemfile:
+              path: gemfiles/rails_7.2.gemfile
+              label: rails-7.2
+          - ruby_version: "3.2"
+            gemfile:
+              path: gemfiles/rails_8.1.gemfile
+              label: rails-8.1
+          # Also exercise the literal minimum runtime/dependency pair, not just
+          # each minimum independently in newer combinations.
+          - ruby_version: "3.2"
+            gemfile:
+              path: gemfiles/pay_minimum.gemfile
+              label: pay-minimum
 
     env:
       RAILS_ENV: test
-      BUNDLE_GEMFILE: ${{ github.workspace }}/${{ matrix.gemfile }}
+      BUNDLE_GEMFILE: ${{ github.workspace }}/${{ matrix.gemfile.path }}
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+
+      - name: Checkout reviewed wallets 0.3 candidate
+        uses: actions/checkout@v7
+        with:
+          repository: rameerez/wallets
+          ref: 743f57e96a7b48e3bb790e63d5cba2e83f4f057b
+          path: wallets-core
+          persist-credentials: false
 
       - name: Set up Ruby ${{ matrix.ruby_version }}
         uses: ruby/setup-ruby@v1
         with:
           ruby-version: ${{ matrix.ruby_version }}
           bundler-cache: true
 
-      - name: Run tests
-        run: bundle exec rake test
+      - name: Prepare database and run tests
+        # Exercise the real migration path in SQLite too so dummy/test schema
+        # drift is caught before release, not only in adapter-specific jobs.
+        run: bundle exec rake db:migrate:reset test
 
       - name: Upload test results
         if: failure()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
-          name: test-results-sqlite-ruby-${{ matrix.ruby_version }}-${{ matrix.gemfile }}
+          name: test-results-sqlite-ruby-${{ matrix.ruby_version }}-${{ matrix.gemfile.label }}
           path: test/reports/
           retention-days: 7
 
+  security:
+    runs-on: ubuntu-latest
+
+    strategy:
+      fail-fast: false
+      matrix:
+        gemfile:
+          - path: Gemfile
+            label: default
+          - path: gemfiles/rails_7.2.gemfile
+            label: rails-7.2
+          - path: gemfiles/rails_8.1.gemfile
+            label: rails-8.1
+          - path: gemfiles/pay_minimum.gemfile
+            label: pay-minimum
+
+    env:
+      BUNDLE_GEMFILE: ${{ github.workspace }}/${{ matrix.gemfile.path }}
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+
+      - name: Checkout reviewed wallets 0.3 candidate
+        uses: actions/checkout@v7
+        with:
+          repository: rameerez/wallets
+          ref: 743f57e96a7b48e3bb790e63d5cba2e83f4f057b
+          path: wallets-core
+          persist-credentials: false
+
+      - name: Set up Ruby
+        uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: "3.4"
+          bundler-cache: true
+
+      - name: Audit locked dependencies
+        # ruby/setup-ruby may remove an untracked lock after populating its
+        # cache, and bundler-audit does not infer the appraisal lock path from
+        # BUNDLE_GEMFILE. Its --gemfile-lock value is relative to the scan root,
+        # so strip the absolute workspace prefix before auditing.
+        run: |
+          bundle lock
+          lockfile="${BUNDLE_GEMFILE#"$GITHUB_WORKSPACE/"}.lock"
+          bundle exec bundle-audit check --update --gemfile-lock "$lockfile"
+
   # PostgreSQL compatibility tests
   postgres:
     runs-on: ubuntu-latest
 
     strategy:
       fail-fast: false
       matrix:
-        ruby_version: ["3.4"]
+        include:
+          - ruby_version: "3.4"
+            gemfile:
+              path: Gemfile
+              label: default
+          # Real-adapter coverage for the literal minimum supported
+          # Ruby/Rails/Pay boundary, not only the modern dependency graph.
+          - ruby_version: "3.2"
+            gemfile:
+              path: gemfiles/rails_7.2.gemfile
+              label: minimum
 
     services:
       postgres:
@@ -82,10 +179,21 @@ jobs:
     env:
       RAILS_ENV: test
       DATABASE_URL: postgres://postgres:postgres@localhost:5432/usage_credits_test
+      BUNDLE_GEMFILE: ${{ github.workspace }}/${{ matrix.gemfile.path }}
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+
+      - name: Checkout reviewed wallets 0.3 candidate
+        uses: actions/checkout@v7
+        with:
+          repository: rameerez/wallets
+          ref: 743f57e96a7b48e3bb790e63d5cba2e83f4f057b
+          path: wallets-core
+          persist-credentials: false
 
       - name: Set up Ruby ${{ matrix.ruby_version }}
         uses: ruby/setup-ruby@v1
@@ -104,9 +212,9 @@ jobs:
 
       - name: Upload test results
         if: failure()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
-          name: test-results-postgres-ruby-${{ matrix.ruby_version }}
+          name: test-results-postgres-ruby-${{ matrix.ruby_version }}-${{ matrix.gemfile.label }}
           path: test/reports/
           retention-days: 7
 
@@ -117,7 +225,17 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        ruby_version: ["3.4"]
+        include:
+          - ruby_version: "3.4"
+            gemfile:
+              path: Gemfile
+              label: default
+          # Real-adapter coverage for the literal minimum supported
+          # Ruby/Rails/Pay boundary, not only the modern dependency graph.
+          - ruby_version: "3.2"
+            gemfile:
+              path: gemfiles/rails_7.2.gemfile
+              label: minimum
 
     services:
       mysql:
@@ -136,10 +254,21 @@ jobs:
     env:
       RAILS_ENV: test
       DATABASE_URL: mysql2://root:root@127.0.0.1:3306/usage_credits_test
+      BUNDLE_GEMFILE: ${{ github.workspace }}/${{ matrix.gemfile.path }}
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+
+      - name: Checkout reviewed wallets 0.3 candidate
+        uses: actions/checkout@v7
+        with:
+          repository: rameerez/wallets
+          ref: 743f57e96a7b48e3bb790e63d5cba2e83f4f057b
+          path: wallets-core
+          persist-credentials: false
 
       - name: Set up Ruby ${{ matrix.ruby_version }}
         uses: ruby/setup-ruby@v1
@@ -158,8 +287,8 @@ jobs:
 
       - name: Upload test results
         if: failure()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
-          name: test-results-mysql-ruby-${{ matrix.ruby_version }}
+          name: test-results-mysql-ruby-${{ matrix.ruby_version }}-${{ matrix.gemfile.label }}
           path: test/reports/
           retention-days: 7

.gitignore

@@ -3,6 +3,7 @@
 /_yardoc/
 /coverage/
 /doc/
+/rdoc/
 /pkg/
 /spec/reports/
 /tmp/
@@ -33,4 +34,4 @@ deploy.yml
 .aux/
 
 TODO
-pay.md
+pay.md

.simplecov

@@ -1,27 +1,35 @@
 # frozen_string_literal: true
 
-# SimpleCov configuration file (auto-loaded before test suite)
-# This keeps test_helper.rb clean and follows best practices
+# SimpleCov configuration file, auto-loaded when the test helper starts
+# coverage. Keep startup in test_helper.rb so this file remains configuration-only.
+
+SimpleCov.configure do
+  # Allow release/CI verification to use an isolated result set. Reusing a
+  # developer's previous coverage directory can merge stale runs and hide a
+  # regression that would fail in a clean checkout.
+  coverage_dir ENV.fetch("COVERAGE_DIR", "coverage")
 
-SimpleCov.start do
   # Use SimpleFormatter for terminal-only output (no HTML generation)
   formatter SimpleCov::Formatter::SimpleFormatter
 
-  # Track coverage for the lib directory (gem source code)
-  add_filter "/test/"
-
-  # Track Ruby files in lib directory
-  track_files "lib/**/*.rb"
+  if respond_to?(:skip)
+    # SimpleCov 1.x vocabulary.
+    skip "/test/"
+    cover "lib/**/*.rb"
+  else
+    # Fallback vocabulary for SimpleCov 0.22.
+    add_filter "/test/"
+    track_files "lib/**/*.rb"
+  end
 
   # Enable branch coverage for more detailed metrics
   enable_coverage :branch
 
-  # Set minimum coverage threshold to prevent coverage regression
-  # Current coverage: Line 88.56%, Branch 81.17%
+  # Set minimum coverage thresholds to prevent coverage regressions.
   minimum_coverage line: 80, branch: 75
 
   # Disambiguate parallel test runs
-  command_name "Job #{ENV['TEST_ENV_NUMBER']}" if ENV['TEST_ENV_NUMBER']
+  command_name "Job #{ENV["TEST_ENV_NUMBER"]}" if ENV["TEST_ENV_NUMBER"]
 end
 
 # Print coverage summary to terminal after tests complete

.standard.yml

@@ -0,0 +1,5 @@
+ruby_version: 3.1
+
+ignore:
+  - test/dummy/bin/**/*
+  - test/dummy/db/*_schema.rb

Appraisals

@@ -1,43 +1,26 @@
 # frozen_string_literal: true
 
+# The generated gemfiles intentionally retain the root Gemfile's conditional
+# WALLETS_PATH hook for coordinated pre-release CI. Appraisal cannot emit that
+# runtime conditional itself, so preserve the postamble when regenerating.
+
 # Test minimum supported Rails version (with latest Pay)
 appraise "rails-7.2" do
   gem "rails", "~> 7.2.0"
-  gem "pay", "~> 11.0"
-  gem "stripe", "~> 18.0"
+  gem "pay", ">= 11.6.2", "< 12.0"
+  gem "stripe", "~> 19.0"
 end
 
 # Test latest Rails version (with latest Pay) - this is the default/main Gemfile anyway
 appraise "rails-8.1" do
   gem "rails", "~> 8.1.0"
-  gem "pay", "~> 11.0"
-  gem "stripe", "~> 18.0"
-end
-
-# Test minimum supported Pay version (with latest Rails)
-appraise "pay-8.3" do
-  gem "pay", "~> 8.3.0"
-  gem "stripe", "~> 13.0"
-  gem "rails", "~> 8.1.0"
-end
-
-# Test Pay 9.0 (popular stable version with latest Rails)
-appraise "pay-9.0" do
-  gem "pay", "~> 9.0.0"
-  gem "stripe", "~> 13.0"
-  gem "rails", "~> 8.1.0"
-end
-
-# Test Pay 10.0 (with latest Rails)
-appraise "pay-10.0" do
-  gem "pay", "~> 10.0.0"
-  gem "stripe", "~> 15.0"
-  gem "rails", "~> 8.1.0"
+  gem "pay", ">= 11.6.2", "< 12.0"
+  gem "stripe", "~> 19.0"
 end
 
-# Test latest Pay version (with latest Rails)
-appraise "pay-11.0" do
-  gem "pay", "~> 11.0"
-  gem "stripe", "~> 18.0"
+# Test the exact minimum secure supported Pay version (with latest Rails)
+appraise "pay-minimum" do
+  gem "pay", "= 11.6.2"
+  gem "stripe", "~> 19.0"
   gem "rails", "~> 8.1.0"
 end