YJIT: Run test-all tests without requiring RUN_OPTS

Most tests in test_yjit.rb use a sub process, so we can run them even when the parent process is not running with YJIT. Run them so simply running `make check` tests YJIT a bit. [Misc #19149]
author: Alan Wu <XrXr@users.noreply.github.com> 2022-11-25 13:13:09 -0500
committer: Alan Wu <XrXr@users.noreply.github.com> 2022-11-25 17:15:24 -0500
commit: 1d64a5a7c09d1029508b6b3cb3d04e5a939bc8f8 (patch)
tree: aa447cb2b46da4ac5b5f7ebc9b8620c4b9f0214a /array.c
parent: 790cf4b6d0475614afb127b416e87cfa39044d67 (diff)
0 files changed, 0 insertions, 0 deletions
diff --git a/.appveyor.yml b/.appveyor.yml
index 1ea5e59210..05ff204541 100644
--- a/.appveyor.yml
+++ b/.appveyor.yml
@@ -17,18 +17,18 @@ skip_commits:
     - '**/*.md'
     - '**/*.rdoc'
     - '**/.document'
+    - '**/*.[1-8]'
+    - '**/*.ronn'
 environment:
   ruby_version: "24-%Platform%"
-  zlib_version: "1.2.12"
   matrix:
+    # Test only the oldest supported version because AppVeyor is unstable, its concurrency
+    # is limited, and compatibility issues that happen only in newer versions are rare.
+    # You may test some other stuff on GitHub Actions instead.
     - build: vs
-      vs: 120
-      ssl: OpenSSL
-      APPVEYOR_BUILD_WORKER_IMAGE: Visual Studio 2015
-      GEMS_FOR_TEST: ""
-    - build: vs
-      vs: 140
+      vs: 120 # Visual Studio 2013
       ssl: OpenSSL-v111
+      # The worker image name. This is NOT the Visual Studio version we're using here.
       APPVEYOR_BUILD_WORKER_IMAGE: Visual Studio 2015
       GEMS_FOR_TEST: ""
   RELINE_TEST_ENCODING: "UTF-8"
@@ -48,8 +48,9 @@ for:
     - cd C:\Tools\vcpkg
     - git pull -q
     - .\bootstrap-vcpkg.bat
+    - ps: Start-FileDownload 'https://github.com/microsoft/vcpkg-tool/releases/download/2023-08-09/vcpkg.exe' -FileName 'C:\Tools\vcpkg\vcpkg.exe'
     - cd %APPVEYOR_BUILD_FOLDER%
-    - vcpkg --triplet %Platform%-windows install libffi libyaml readline zlib
+    - vcpkg --triplet %Platform%-windows install --x-use-aria2 libffi libyaml readline zlib
     - CALL SET vcvars=%%^VS%VS%COMNTOOLS^%%..\..\VC\vcvarsall.bat
     - SET vcvars
     - '"%vcvars%" %Platform:x64=amd64%'
@@ -69,9 +70,6 @@ for:
     - mkdir \usr\local\bin
     - mkdir \usr\local\include
     - mkdir \usr\local\lib
-    - SET ZLIB_ZIP=.downloaded-cache\zlib%zlib_version:.=%.zip
-    - if not exist %ZLIB_ZIP% curl -fsSL -o %ZLIB_ZIP% --retry 10 https://zlib.net/zlib%zlib_version:.=%.zip
-    - 7z x -aos -o%APPVEYOR_BUILD_FOLDER%\ext\zlib %ZLIB_ZIP%
     - for %%I in (%OPENSSL_DIR%\*.dll) do mklink /h \usr\local\bin\%%~nxI %%I
     - for %%I in (c:\Tools\vcpkg\installed\%Platform%-windows\bin\*.dll) do (
         if not %%~nI == readline mklink \usr\local\bin\%%~nxI %%I
@@ -79,6 +77,7 @@ for:
     - attrib +r /s /d
     - mkdir %Platform%-mswin_%vs%
   build_script:
+    - set HAVE_GIT=no
     - cd %APPVEYOR_BUILD_FOLDER%
     - cd %Platform%-mswin_%vs%
     - >-
@@ -95,7 +94,7 @@ for:
     - nmake -l "TESTOPTS=-v -q" btest
     - nmake -l "TESTOPTS=-v -q" test-basic
     - >-
-      nmake -l "TESTOPTS=-v --timeout-scale=3.0
+      nmake -l "TESTOPTS=--timeout-scale=3.0
       --excludes=../test/excludes/_appveyor -j%JOBS%
       --exclude win32ole
       --exclude test_bignum
@@ -106,7 +105,7 @@ for:
     # separately execute tests without -j which may crash worker with -j.
     - >-
       nmake -l
-      "TESTOPTS=-v --timeout-scale=3.0 --excludes=../test/excludes/_appveyor"
+      "TESTOPTS=--timeout-scale=3.0 --excludes=../test/excludes/_appveyor"
       TESTS="
       ../test/win32ole
       ../test/ruby/test_bignum.rb
@@ -124,7 +123,7 @@ notifications:
       {{^isPullRequest}}
         {
           "ci": "AppVeyor CI",
-          "env": "Visual Studio 2013 / 2015",
+          "env": "Visual Studio 2013",
           "url": "{{buildUrl}}",
           "commit": "{{commitId}}",
           "branch": "{{branch}}"
diff --git a/.cirrus.yml b/.cirrus.yml
deleted file mode 100644
index 854a3df982..0000000000
--- a/.cirrus.yml
+++ /dev/null
@@ -1,134 +0,0 @@
-# This CI is used to test Arm cases. We can set the maximum 16 tasks.
-# The entire testing design is inspired from .github/workflows/compilers.yml.
-
-# By default, Cirrus mounts an empty volume to `/tmp`
-# which triggers all sorts of warnings like "system temporary path is world-writable: /tmp".
-# Lets workaround it by specifying a custom volume mount point.
-env:
-  CIRRUS_VOLUME: /cirrus-ci-volume
-  LANG: C.UTF-8
-
-task:
-  name: Arm64 Graviton2 / $CC
-  skip: "changesIncludeOnly('doc/**', '**.{md,rdoc}', '.document')"
-  arm_container:
-    # We use the arm64 images at https://github.com/ruby/ruby-ci-image/pkgs/container/ruby-ci-image .
-    image: ghcr.io/ruby/ruby-ci-image:$CC
-    # Define the used cpu core in each matrix task. We can use total 16 cpu
-    # cores in entire matrix. [cpu] = [total cpu: 16] / [number of tasks]
-    cpu: 8
-    # We can request maximum 4 GB per cpu.
-    # [memory per task] = [memory per cpu: 4 GB] * [cpu]
-    memory: 32G
-  env:
-    CIRRUS_CLONE_DEPTH: 50
-    optflags: '-O1'
-    debugflags: '-ggdb3'
-    RUBY_PREFIX: /tmp/ruby-prefix
-    RUBY_DEBUG: ci rgengc
-    RUBY_TESTOPTS: >-
-      -q
-      --color=always
-      --tty=no
-    matrix:
-      CC: clang-12
-      CC: gcc-11
-  id_script: id
-  set_env_script:
-    # Set `GNUMAKEFLAGS`, because the flags are GNU make specific. Note using
-    # the `make` environment variable used in compilers.yml causes some rubygems
-    # tests to fail.
-    # https://github.com/rubygems/rubygems/issues/4921
-    - echo "GNUMAKEFLAGS=-s -j$((1 + $CIRRUS_CPU))" >> $CIRRUS_ENV
-  print_env_script:
-    - echo "GNUMAKEFLAGS=$GNUMAKEFLAGS"
-  # Arm containers are executed in AWS's EKS, and it's not yet supporting IPv6
-  # See https://github.com/aws/containers-roadmap/issues/835
-  disable_ipv6_script: sudo ./tool/disable_ipv6.sh
-  autogen_script: ./autogen.sh
-  configure_script: >-
-    ./configure -C
-    --enable-debug-env
-    --disable-install-doc
-    --with-ext=-test-/cxxanyargs,+
-    --prefix="$RUBY_PREFIX"
-  make_extract-extlibs_script: make extract-extlibs
-  make_incs_script: make incs
-  make_script: make
-  make_leaked-globals_script: make leaked-globals
-  make_test_script: make test
-  make_install_script: make install
-  install_gems_for_test_script: $RUBY_PREFIX/bin/gem install --no-doc timezone tzinfo
-  make_test-tool_script: make test-tool
-  make_test-all_script: make test-all
-  make_test-spec_script: make test-spec
-
-# The following is to test YJIT on ARM64 CPUs available on Cirrus CI
-yjit_task:
-  name: Arm64 Graviton2 / $CC YJIT
-  auto_cancellation: $CIRRUS_BRANCH != 'master'
-  skip: "changesIncludeOnly('doc/**', '**.{md,rdoc}')"
-  arm_container:
-    # We use the arm64 images at https://github.com/ruby/ruby-ci-image/pkgs/container/ruby-ci-image .
-    image: ghcr.io/ruby/ruby-ci-image:$CC
-    # Define the used cpu core in each matrix task. We can use total 16 cpu
-    # cores in entire matrix. [cpu] = [total cpu: 16] / [number of tasks]
-    cpu: 8
-    # We can request maximum 4 GB per cpu.
-    # [memory per task] = [memory per cpu: 4 GB] * [cpu]
-    memory: 32G
-  env:
-    CIRRUS_CLONE_DEPTH: 50
-    optflags: '-O1'
-    debugflags: '-ggdb3'
-    RUBY_PREFIX: /tmp/ruby-prefix
-    RUBY_DEBUG: ci rgengc
-    RUBY_TESTOPTS: >-
-      -q
-      --color=always
-      --tty=no
-    matrix:
-      - CC: clang-12
-        configure: --enable-yjit=dev
-        rustup_init: --default-toolchain=1.58.1
-      - CC: gcc-11
-        configure: --enable-yjit
-  id_script: id
-  set_env_script:
-    # Set `GNUMAKEFLAGS`, because the flags are GNU make specific. Note using
-    # the `make` environment variable used in compilers.yml causes some rubygems
-    # tests to fail.
-    # https://github.com/rubygems/rubygems/issues/4921
-    - echo "GNUMAKEFLAGS=-s -j$((1 + $CIRRUS_CPU))" >> $CIRRUS_ENV
-  print_env_script:
-    - echo "GNUMAKEFLAGS=$GNUMAKEFLAGS"
-  # Arm containers are executed in AWS's EKS, and it's not yet supporting IPv6
-  # See https://github.com/aws/containers-roadmap/issues/835
-  disable_ipv6_script: sudo ./tool/disable_ipv6.sh
-  install_rust_script:
-    - sudo apt-get update -y
-    - sudo apt-get install -y curl
-    - "curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y $rustup_init"
-  autogen_script: ./autogen.sh
-  configure_script: >-
-    source $HOME/.cargo/env && ./configure -C
-    --enable-debug-env
-    --disable-install-doc
-    --with-ext=-test-/cxxanyargs,+
-    --prefix="$RUBY_PREFIX"
-    $configure
-  make_miniruby_script: source $HOME/.cargo/env && make miniruby
-  make_bindgen_script: |
-    if [[ "$CC" = "clang-12" ]]; then
-      source $HOME/.cargo/env && make yjit-bindgen
-    else
-      echo "only running bindgen on clang image"
-    fi
-  boot_miniruby_script: RUST_BACKTRACE=1 ./miniruby --yjit-call-threshold=1 -e0
-  test_dump_insns_script: RUST_BACKTRACE=1 ./miniruby --yjit-call-threshold=1 --yjit-dump-insns -e0
-  output_stats_script: RUST_BACKTRACE=1 ./miniruby --yjit-call-threshold=1 --yjit-stats -e0
-  full_build_script: source $HOME/.cargo/env && make
-  cargo_test_script: source $HOME/.cargo/env && cd yjit && cargo test
-  make_test_script: source $HOME/.cargo/env && make test RUN_OPTS="--yjit-call-threshold=1 --yjit-verify-ctx"
-  make_test_all_script: source $HOME/.cargo/env && make test-all RUN_OPTS="--yjit-call-threshold=1" TESTOPTS="$RUBY_TESTOPTS"
-  make_test_spec_script: source $HOME/.cargo/env && make test-spec RUN_OPTS="--yjit-call-threshold=1"
diff --git a/.document b/.document
index ec2fa09326..3a6b0c238c 100644
--- a/.document
+++ b/.document
@@ -18,15 +18,18 @@ gc.rb
 io.rb
 kernel.rb
 marshal.rb
+mjit.rb
 numeric.rb
 nilclass.rb
 pack.rb
 ractor.rb
 string.rb
+symbol.rb
 timev.rb
 thread_sync.rb
 trace_point.rb
 warning.rb
+yjit.rb
 
 # the lib/ directory (which has its own .document file)
 lib
diff --git a/.github/auto_request_review.yml b/.github/auto_request_review.yml
deleted file mode 100644
index d058b6ca00..0000000000
--- a/.github/auto_request_review.yml
+++ /dev/null
@@ -1,9 +0,0 @@
-files:
-  'yjit*': [team:yjit]
-  'yjit/**/*': [team:yjit]
-  'doc/yjit/*': [team:yjit]
-  'bootstraptest/test_yjit*': [team:yjit]
-  'test/ruby/test_yjit*': [team:yjit]
-  '.github/workflows/yjit*': [team:yjit]
-options:
-  ignore_draft: true
diff --git a/.github/codeql/codeql-config.yml b/.github/codeql/codeql-config.yml
index 6036043d8c..91f82b842b 100644
--- a/.github/codeql/codeql-config.yml
+++ b/.github/codeql/codeql-config.yml
@@ -1,7 +1,3 @@
 name: "CodeQL config for the Ruby language"
 
 languages: cpp
-
-# syntax_suggest consumes an hour.
-paths-ignore:
-  - lib/syntax_suggest
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index b18fd29357..bc63aca35b 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -3,4 +3,4 @@ updates:
   - package-ecosystem: 'github-actions'
     directory: '/'
     schedule:
-      interval: 'weekly'
+      interval: 'monthly'
diff --git a/.github/workflows/auto_request_review.yml b/.github/workflows/auto_request_review.yml
deleted file mode 100644
index 7e163de697..0000000000
--- a/.github/workflows/auto_request_review.yml
+++ /dev/null
@@ -1,14 +0,0 @@
-name: Auto Request Review
-on:
-  pull_request_target:
-    types: [opened, ready_for_review, reopened]
-jobs:
-  auto-request-review:
-    name: Auto Request Review
-    runs-on: ubuntu-latest
-    steps:
-      - name: Request review based on files changes and/or groups the author belongs to
-        uses: necojackarc/auto-request-review@e08cdffa277d50854744de3f76230260e61c67f4 # v0.7.0, checking sha
-        with:
-          # scope: public_repo
-          token: ${{ secrets.MATZBOT_GITHUB_TOKEN }}
diff --git a/.github/workflows/baseruby.yml b/.github/workflows/baseruby.yml
index 1c314da911..ebaafe3bf0 100644
--- a/.github/workflows/baseruby.yml
+++ b/.github/workflows/baseruby.yml
@@ -4,22 +4,36 @@ on:
   push:
     paths-ignore:
       - 'doc/**'
+      - '**/man'
       - '**.md'
       - '**.rdoc'
+      - '**/.document'
   pull_request:
     paths-ignore:
       - 'doc/**'
+      - '**/man'
       - '**.md'
       - '**.rdoc'
+      - '**/.document'
+  merge_group:
+    paths-ignore:
+      - 'doc/**'
+      - '**/man'
+      - '**.md'
+      - '**.rdoc'
+      - '**/.document'
 
 concurrency:
   group: ${{ github.workflow }} / ${{ startsWith(github.event_name, 'pull') && github.ref_name || github.sha }}
   cancel-in-progress: ${{ startsWith(github.event_name, 'pull') }}
 
+permissions:
+  contents: read
+
 jobs:
   baseruby:
     name: BASERUBY
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-22.04
     if: ${{ !contains(github.event.head_commit.message, '[DOC]') && !contains(github.event.pull_request.labels.*.name, 'Documentation') }}
     strategy:
       matrix:
@@ -34,12 +48,12 @@ jobs:
           - ruby-3.1
 
     steps:
-      - uses: actions/checkout@v3
-      - uses: actions/cache@v3
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
         with:
           path: .downloaded-cache
           key: downloaded-cache
-      - uses: ruby/setup-ruby@v1
+      - uses: ruby/setup-ruby@13e7a03dc3ac6c3798f4570bfead2aed4d96abfb # v1.244.0
         with:
           ruby-version: ${{ matrix.ruby }}
           bundler: none
@@ -51,7 +65,7 @@ jobs:
       - run: make incs
       - run: make all
       - run: make test
-      - uses: k0kubun/action-slack@v2.0.0
+      - uses: ruby/action-slack@0bd85c72233cdbb6a0fe01d37aaeff1d21b5fce1 # v3.2.1
         with:
           payload: |
             {
@@ -59,7 +73,7 @@ jobs:
               "env": "${{ github.workflow }} / BASERUBY @ ${{ matrix.ruby }}",
               "url": "https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}",
               "commit": "${{ github.sha }}",
-              "branch": "${{ github.ref }}".split('/').reverse()[0]
+              "branch": "${{ github.ref_name }}"
             }
         env:
           SLACK_WEBHOOK_URL: ${{ secrets.SIMPLER_ALERTS_URL }} # ruby-lang slack: ruby/simpler-alerts-bot
diff --git a/.github/workflows/bundled_gems.yml b/.github/workflows/bundled_gems.yml
index f6f8b9a45b..070c0fa1dd 100644
--- a/.github/workflows/bundled_gems.yml
+++ b/.github/workflows/bundled_gems.yml
@@ -2,18 +2,31 @@ name: bundled_gems
 
 on:
   push:
+    branches: [ "master" ]
     paths:
       - '.github/workflows/bundled_gems.yml'
       - 'gems/bundled_gems'
   pull_request:
+    branches: [ "master" ]
+    paths:
+      - '.github/workflows/bundled_gems.yml'
+      - 'gems/bundled_gems'
+  merge_group:
+    branches: [ "master" ]
     paths:
       - '.github/workflows/bundled_gems.yml'
       - 'gems/bundled_gems'
   schedule:
     - cron: '45 6 * * *'
+  workflow_dispatch:
+
+permissions:  # added using https://github.com/step-security/secure-workflows
+  contents: read
 
 jobs:
   update:
+    permissions:
+      contents: write  # for Git to git push
     if: ${{ github.event_name != 'schedule' || github.repository == 'ruby/ruby' }}
     name: update ${{ github.workflow }}
     runs-on: ubuntu-latest
@@ -28,9 +41,9 @@ jobs:
           echo "GNUMAKEFLAGS=-j$((1 + $(nproc --all)))" >> $GITHUB_ENV
           echo "TODAY=$(date +%F)" >> $GITHUB_ENV
 
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
-      - uses: actions/cache@v3
+      - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
         with:
           path: .downloaded-cache
           key: downloaded-cache-${{ github.sha }}
@@ -68,14 +81,14 @@ jobs:
               [g, v] unless last[g] == v
             end
             changed, added = changed.partition {|g, _| last[g]}
-            news.sub!(/^\*( +)The following #{type} gems? are updated\.\n\K(?: \1\* .*\n)*/) do
-              mark = "#{$1} * "
+            news.sub!(/^\*( +)The following #{type} gems? are updated\.\n+\K(?: \1\*( +).*\n)*/) do
+              mark = "#{$1} *#{$2}"
               changed.map {|g, v|"#{mark}#{g} #{v}\n"}.join("")
             end or next
-            news.sub!(/^\*( +)The following default gems are now bundled gems\.\n\K(?: \1\* .*\n)*/) do
-              mark = "#{$1} * "
+            news.sub!(/^\*( +)The following default gems are now bundled gems\.\n+\K(?: \1\*( +).*\n)*/) do
+              mark = "#{$1} *#{$2}"
               added.map {|g, v|"#{mark}#{g} #{v}\n"}.join("")
-            end or next if added
+            end or next unless added.empty?
             File.write("NEWS.md", news)
           end
         shell: ruby {0}
@@ -137,3 +150,17 @@ jobs:
           GIT_AUTHOR_NAME: git
           GIT_COMMITTER_NAME: git
         if: ${{ github.repository == 'ruby/ruby' && !startsWith(github.event_name, 'pull') && steps.show.outcome == 'failure' }}
+
+      - uses: ruby/action-slack@0bd85c72233cdbb6a0fe01d37aaeff1d21b5fce1 # v3.2.1
+        with:
+          payload: |
+            {
+              "ci": "GitHub Actions",
+              "env": "${{ github.workflow }} / update",
+              "url": "https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}",
+              "commit": "${{ github.sha }}",
+              "branch": "${{ github.ref_name }}"
+            }
+        env:
+          SLACK_WEBHOOK_URL: ${{ secrets.SIMPLER_ALERTS_URL }} # ruby-lang slack: ruby/simpler-alerts-bot
+        if: ${{ failure() && github.event_name == 'push' }}
diff --git a/.github/workflows/check_dependencies.yml b/.github/workflows/check_dependencies.yml
index fab1989335..79b2916feb 100644
--- a/.github/workflows/check_dependencies.yml
+++ b/.github/workflows/check_dependencies.yml
@@ -3,12 +3,21 @@ on:
   push:
     paths-ignore:
       - 'doc/**'
+      - '**/man'
       - '**.md'
       - '**.rdoc'
       - '**/.document'
   pull_request:
     paths-ignore:
       - 'doc/**'
+      - '**/man'
+      - '**.md'
+      - '**.rdoc'
+      - '**/.document'
+  merge_group:
+    paths-ignore:
+      - 'doc/**'
+      - '**/man'
       - '**.md'
       - '**.rdoc'
       - '**/.document'
@@ -17,11 +26,14 @@ concurrency:
   group: ${{ github.workflow }} / ${{ startsWith(github.event_name, 'pull') && github.ref_name || github.sha }}
   cancel-in-progress: ${{ startsWith(github.event_name, 'pull') }}
 
+permissions:
+  contents: read
+
 jobs:
   update-deps:
     strategy:
       matrix:
-        os: [ubuntu-20.04]
+        os: [ubuntu-22.04]
       fail-fast: true
     runs-on: ${{ matrix.os }}
     if: ${{ !contains(github.event.head_commit.message, '[DOC]') && !contains(github.event.pull_request.labels.*.name, 'Documentation') }}
@@ -34,15 +46,14 @@ jobs:
         if: ${{ contains(matrix.os, 'ubuntu') }}
       - name: Install libraries
         run: |
-          brew upgrade
           brew install gmp libffi openssl@1.1 zlib autoconf automake libtool readline
         if: ${{ contains(matrix.os, 'macos') }}
       - name: git config
         run: |
           git config --global advice.detachedHead 0
           git config --global init.defaultBranch garbage
-      - uses: actions/checkout@v3
-      - uses: actions/cache@v3
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
         with:
           path: .downloaded-cache
           key: downloaded-cache
@@ -52,7 +63,7 @@ jobs:
       - run: make all golf
       - run: ruby tool/update-deps --fix
       - run: git diff --no-ext-diff --ignore-submodules --exit-code
-      - uses: k0kubun/action-slack@v2.0.0
+      - uses: ruby/action-slack@0bd85c72233cdbb6a0fe01d37aaeff1d21b5fce1 # v3.2.1
         with:
           payload: |
             {
@@ -60,7 +71,7 @@ jobs:
               "env": "${{ matrix.os }} / Dependencies need to update",
               "url": "https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}",
               "commit": "${{ github.sha }}",
-              "branch": "${{ github.ref }}".split('/').reverse()[0]
+              "branch": "${{ github.ref_name }}"
             }
         env:
           SLACK_WEBHOOK_URL: ${{ secrets.SIMPLER_ALERTS_URL }} # ruby-lang slack: ruby/simpler-alerts-bot
diff --git a/.github/workflows/check_misc.yml b/.github/workflows/check_misc.yml
deleted file mode 100644
index 32a07f7fd6..0000000000
--- a/.github/workflows/check_misc.yml
+++ /dev/null
@@ -1,99 +0,0 @@
-name: Miscellaneous checks
-on: [push, pull_request]
-
-concurrency:
-  group: ${{ github.workflow }} / ${{ startsWith(github.event_name, 'pull') && github.ref_name || github.sha }}
-  cancel-in-progress: ${{ startsWith(github.event_name, 'pull') }}
-
-jobs:
-  checks:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v3
-      - name: Check if C-sources are US-ASCII
-        run: |
-          ! grep -r -n '[^	 -~]' *.[chy] include internal win32/*.[ch]
-      - name: Check for trailing spaces
-        run: |
-          ! git grep -n '[	 ]$' '*.rb' '*.[chy]'
-      - name: Check for header macros
-        run: |
-          ! for header in ruby/*.h; do \
-            git grep -l -F -e $header -e HAVE_`echo $header | tr a-z./ A-Z__` -- . > /dev/null || echo $header
-          done | grep -F .
-        working-directory: include
-
-      - uses: actions/cache@v3
-        with:
-          path: .downloaded-cache
-          key: downloaded-cache-${{ github.sha }}
-          restore-keys: |
-            downloaded-cache
-
-      - name: Download previous gems list
-        run: |
-          data=default_gems.json
-          mkdir -p .downloaded-cache
-          ln -s .downloaded-cache/$data .
-          curl -O -R -z ./$data https://stdgems.org/$data
-
-      - name: Make default gems list
-        run: |
-          #!ruby
-          require 'rubygems'
-          $:.unshift "lib"
-          rgver = File.foreach("lib/rubygems.rb") do |line|
-            break $1 if /^\s*VERSION\s*=\s*"([^"]+)"/ =~ line
-          end
-          gems = Dir.glob("{ext,lib}/**/*.gemspec").map do |f|
-            spec = Gem::Specification.load(f)
-            "#{spec.name} #{spec.version}"
-          end.sort
-          File.open("gems/default_gems", "w") do |f|
-            f.puts "RubyGems #{rgver}"
-            f.puts gems
-          end
-        shell: ruby --disable=gems {0}
-
-      - name: Maintain updated gems list in NEWS
-        run: |
-          #!ruby
-          require 'json'
-          news = File.read("NEWS.md")
-          prev = news[/since the \*+(\d+\.\d+\.\d+)\*+/, 1]
-          prevs = [prev, prev.sub(/\.\d+\z/, '')]
-          %W[default].each do |type|
-            last = JSON.parse(File.read("#{type}_gems.json"))['gems'].filter_map do |g|
-              v = g['versions'].values_at(*prevs).compact.first
-              g = g['gem']
-              g = 'RubyGems' if g == 'rubygems'
-              [g, v] if v
-            end.to_h
-            changed = File.foreach("gems/#{type}_gems").filter_map do |l|
-              next if l.start_with?("#")
-              g, v = l.split(" ", 3)
-              [g, v] unless last[g] == v
-            end
-            news.sub!(/^\*( +)The following #{type} gems? are updated\.\n\K(?: \1\* .*\n)*/) do
-              mark = "#{$1} * "
-              changed.map {|g, v|"#{mark}#{g} #{v}\n"}.join("")
-            end or next
-            File.write("NEWS.md", news)
-          end
-        shell: ruby {0}
-
-      - name: Check diffs
-        id: diff
-        run: |
-          git diff --color --no-ext-diff --ignore-submodules --exit-code NEWS.md
-        continue-on-error: true
-      - name: Commit
-        run: |
-          git pull --ff-only origin ${GITHUB_REF#refs/heads/}
-          git commit --message="Update default gems list at ${GITHUB_SHA:0:30} [ci skip]" NEWS.md
-          git push origin ${GITHUB_REF#refs/heads/}
-        env:
-          EMAIL: svn-admin@ruby-lang.org
-          GIT_AUTHOR_NAME: git
-          GIT_COMMITTER_NAME: git
-        if: ${{ github.repository == 'ruby/ruby' && !startsWith(github.event_name, 'pull') && steps.diff.outcome == 'failure' }}
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index f9fa0a7449..8dba76fbe2 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -1,31 +1,42 @@
 name: "Code scanning - action"
 
 on:
-  push:
-    paths-ignore:
-      - 'doc/**'
-      - '**.md'
-      - '**.rdoc'
-      - '**/.document'
-  pull_request:
-    paths-ignore:
-      - 'doc/**'
-      - '**.md'
-      - '**.rdoc'
-      - '**/.document'
+  # push:
+  #   paths-ignore:
+  #     - 'doc/**'
+  #     - '**/man'
+  #     - '**.md'
+  #     - '**.rdoc'
+  #     - '**/.document'
+  # pull_request:
+  #   paths-ignore:
+  #     - 'doc/**'
+  #     - '**/man'
+  #     - '**.md'
+  #     - '**.rdoc'
+  #     - '**/.document'
   schedule:
-    - cron: '0 12 * * 4'
+    - cron: '0 12 * * *'
+  workflow_dispatch:
 
 concurrency:
   group: ${{ github.workflow }} / ${{ startsWith(github.event_name, 'pull') && github.ref_name || github.sha }}
   cancel-in-progress: ${{ startsWith(github.event_name, 'pull') }}
 
+permissions:  # added using https://github.com/step-security/secure-workflows
+  contents: read
+
 jobs:
   CodeQL-Build:
 
     # CodeQL runs on ubuntu-latest and windows-latest
+    permissions:
+      actions: read  # for github/codeql-action/init to get workflow details
+      contents: read  # for actions/checkout to fetch code
+      security-events: write  # for github/codeql-action/autobuild to send a status report
     runs-on: ubuntu-latest
-    if: ${{ !contains(github.event.head_commit.message, '[DOC]') && !contains(github.event.pull_request.labels.*.name, 'Documentation') }}
+    # CodeQL fails to run pull requests from dependabot due to missing write access to upload results.
+    if: ${{ !contains(github.event.head_commit.message, '[DOC]') && !contains(github.event.pull_request.labels.*.name, 'Documentation') && github.event.head_commit.pusher.name != 'dependabot[bot]' }}
 
     env:
       enable_install_doc: no
@@ -38,9 +49,9 @@ jobs:
         sudo apt-get install --no-install-recommends -q -y build-essential libssl-dev libyaml-dev libreadline6-dev zlib1g-dev libncurses5-dev libffi-dev bison autoconf ruby
 
     - name: Checkout repository
-      uses: actions/checkout@v3
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
-    - uses: actions/cache@v3
+    - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
       with:
         path: .downloaded-cache
         key: downloaded-cache
@@ -49,15 +60,16 @@ jobs:
       run: sudo rm /usr/lib/ruby/vendor_ruby/rubygems/defaults/operating_system.rb
 
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v2
+      uses: github/codeql-action/init@959cbb7472c4d4ad70cdfe6f4976053fe48ab394 # v2.1.37
       with:
         config-file: ./.github/codeql/codeql-config.yml
+        trap-caching: false
 
     - name: Set ENV
       run: echo "GNUMAKEFLAGS=-j$((1 + $(nproc --all)))" >> $GITHUB_ENV
 
     - name: Autobuild
-      uses: github/codeql-action/autobuild@v2
+      uses: github/codeql-action/autobuild@959cbb7472c4d4ad70cdfe6f4976053fe48ab394 # v2.1.37
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v2
+      uses: github/codeql-action/analyze@959cbb7472c4d4ad70cdfe6f4976053fe48ab394 # v2.1.37
diff --git a/.github/workflows/compilers.yml b/.github/workflows/compilers.yml
index 70d0e3ae6c..caf12cc0f4 100644
--- a/.github/workflows/compilers.yml
+++ b/.github/workflows/compilers.yml
@@ -4,13 +4,20 @@ on:
   push:
     paths-ignore:
       - 'doc/**'
+      - '**/man'
       - '**.md'
       - '**.rdoc'
       - '**/.document'
   pull_request:
     paths-ignore:
       - 'doc/**'
-      - '**.md'
+      - '**/man'
+      - '**.rdoc'
+      - '**/.document'
+  merge_group:
+    paths-ignore:
+      - 'doc/**'
+      - '**/man'
       - '**.rdoc'
       - '**/.document'
 
@@ -56,6 +63,9 @@ env:
     --color=always
     --tty=no
 
+permissions:
+  contents: read
+
 jobs:
   compile:
     strategy:
@@ -70,27 +80,13 @@ jobs:
           - { name: gcc-9,     env: { default_cc: gcc-9 } }
           - { name: gcc-8,     env: { default_cc: gcc-8 } }
           - { name: gcc-7,     env: { default_cc: gcc-7 } }
-          - { name: gcc-6,     env: { default_cc: gcc-6 } }
-          - { name: gcc-5,     env: { default_cc: gcc-5 } }
-          - { name: gcc-4.8,   env: { default_cc: gcc-4.8 } }
-          - name: 'gcc-11 LTO'
-            container: gcc-11
+          - name: 'gcc-13 LTO'
+            container: gcc-13
             env:
-              default_cc: 'gcc-11 -flto=auto -ffat-lto-objects'
+              default_cc: 'gcc-13 -flto=auto -ffat-lto-objects -Werror=lto-type-mismatch'
               optflags: '-O2'
             shared: disable
             # check: true
-          - name: 'gcc-11 annocheck'
-            container: gcc-11
-            env:
-              # Minimal flags to pass the check.
-              default_cc: 'gcc-11 -O2 -fcf-protection -Wa,--generate-missing-build-notes=yes'
-              LDFLAGS: '-Wl,-z,now'
-              # FIXME: Drop skipping options
-              # https://bugs.ruby-lang.org/issues/18061
-              # https://sourceware.org/annobin/annobin.html/Test-pie.html
-              TEST_ANNOCHECK_OPTS: "--skip-pie"
-            check: true
           - { name: clang-16,  env: { default_cc: clang-16 } }
           - { name: clang-15,  env: { default_cc: clang-15 } }
           - { name: clang-14,  env: { default_cc: clang-14 } }
@@ -98,17 +94,15 @@ jobs:
           - { name: clang-12,  env: { default_cc: clang-12 } }
           - { name: clang-11,  env: { default_cc: clang-11 } }
           - { name: clang-10,  env: { default_cc: clang-10 } }
-          - { name: clang-9,   env: { default_cc: clang-9 } }
-          - { name: clang-8,   env: { default_cc: clang-8 } }
-          - { name: clang-7,   env: { default_cc: clang-7 } }
-          - { name: clang-6.0, env: { default_cc: clang-6.0 } }
-          - { name: clang-5.0, env: { default_cc: clang-5.0 } }
-          - { name: clang-4.0, env: { default_cc: clang-4.0 } }
-          - { name: clang-3.9, env: { default_cc: clang-3.9 } }
-          - name: 'clang-14 LTO'
-            container: clang-14
+          # llvm-objcopy<=9 doesn't have --wildcard. It compiles, but leaves Rust symbols in libyjit.o.
+          - { name: clang-9,   env: { default_cc: clang-9,   append_configure: '--disable-yjit' } }
+          - { name: clang-8,   env: { default_cc: clang-8,   append_configure: '--disable-yjit' } }
+          - { name: clang-7,   env: { default_cc: clang-7,   append_configure: '--disable-yjit' } }
+          - { name: clang-6.0, env: { default_cc: clang-6.0, append_configure: '--disable-yjit' } }
+          - name: 'clang-16 LTO'
+            container: clang-16
             env:
-              default_cc: 'clang-14 -flto=auto'
+              default_cc: 'clang-16 -flto=auto'
               optflags: '-O2'
             shared: disable
             # check: true
@@ -174,7 +168,11 @@ jobs:
 #         - { name: VM_CHECK_MODE,                  env: { cppflags: '-DVM_CHECK_MODE' } }
 
           - { name: USE_EMBED_CI=0,                 env: { cppflags: '-DUSE_EMBED_CI=0' } }
-          - { name: USE_FLONUM=0,                   env: { cppflags: '-DUSE_FLONUM=0' } }
+          - name: USE_FLONUM=0,
+            env:
+              cppflags: '-DUSE_FLONUM=0'
+              # yjit requires FLONUM for the pointer tagging scheme
+              append_configure: '--disable-yjit'
 #         - { name: USE_GC_MALLOC_OBJ_INFO_DETAILS, env: { cppflags: '-DUSE_GC_MALLOC_OBJ_INFO_DETAILS' } }
           - { name: USE_LAZY_LOAD,                  env: { cppflags: '-DUSE_LAZY_LOAD' } }
 #         - { name: USE_RINCGC=0,                   env: { cppflags: '-DUSE_RINCGC=0' } }
@@ -227,10 +225,10 @@ jobs:
       - name: setenv
         run: |
           echo "GNUMAKEFLAGS=-sj$((1 + $(nproc --all)))" >> $GITHUB_ENV
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           path: src
-      - uses: actions/cache@v3
+      - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
         with:
           path: src/.downloaded-cache
           key: downloaded-cache
@@ -264,7 +262,7 @@ jobs:
       - run: make test-annocheck
         if: ${{ matrix.entry.check && endsWith(matrix.entry.name, 'annocheck') }}
 
-      - uses: k0kubun/action-slack@v2.0.0
+      - uses: ruby/action-slack@0bd85c72233cdbb6a0fe01d37aaeff1d21b5fce1 # v3.2.1
         with:
           payload: |
             {
@@ -272,7 +270,7 @@ jobs:
               "env": "${{ github.workflow }} / ${{ matrix.entry.name }}",
               "url": "https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}",
               "commit": "${{ github.sha }}",
-              "branch": "${{ github.ref }}".split('/').reverse()[0]
+              "branch": "${{ github.ref_name }}"
             }
         env:
           SLACK_WEBHOOK_URL: ${{ secrets.SIMPLER_ALERTS_URL }} # ruby-lang slack: ruby/simpler-alerts-bot
diff --git a/.github/workflows/macos.yml b/.github/workflows/macos.yml
index 72f28a7b61..d8dc58b119 100644
--- a/.github/workflows/macos.yml
+++ b/.github/workflows/macos.yml
@@ -3,12 +3,21 @@ on:
   push:
     paths-ignore:
       - 'doc/**'
+      - '**/man'
       - '**.md'
       - '**.rdoc'
       - '**/.document'
   pull_request:
     paths-ignore:
       - 'doc/**'
+      - '**/man'
+      - '**.md'
+      - '**.rdoc'
+      - '**/.document'
+  merge_group:
+    paths-ignore:
+      - 'doc/**'
+      - '**/man'
       - '**.md'
       - '**.rdoc'
       - '**/.document'
@@ -17,14 +26,18 @@ concurrency:
   group: ${{ github.workflow }} / ${{ startsWith(github.event_name, 'pull') && github.ref_name || github.sha }}
   cancel-in-progress: ${{ startsWith(github.event_name, 'pull') }}
 
+permissions:
+  contents: read
+
 jobs:
   make:
     strategy:
       matrix:
         test_task: ["check"] # "test-bundler-parallel", "test-bundled-gems"
         os:
-          - macos-11
-          - macos-12
+          - macos-13
+          - macos-14
+          - macos-15
       fail-fast: false
     env:
       GITPULLOPTIONS: --no-tags origin ${{github.ref}}
@@ -37,21 +50,21 @@ jobs:
         run: |
           git config --global advice.detachedHead 0
           git config --global init.defaultBranch garbage
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           path: src
-      - uses: actions/cache@v3
+      - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
         with:
           path: src/.downloaded-cache
           key: downloaded-cache
       - name: Install libraries
         run: |
-          brew upgrade
-          brew install gmp libffi openssl@1.1 zlib autoconf automake libtool readline
+          brew install gmp libffi openssl@1.1 zlib autoconf automake libtool readline bison
         working-directory: src
       - name: Set ENV
         run: |
           echo "MAKEFLAGS=-j$((1 + $(sysctl -n hw.activecpu)))" >> $GITHUB_ENV
+          echo "PATH="/usr/local/opt/bison/bin:/opt/homebrew/opt/bison/bin:$PATH"" >> $GITHUB_ENV
       - run: ./autogen.sh
         working-directory: src
       - name: Run configure
@@ -81,7 +94,7 @@ jobs:
           PRECHECK_BUNDLED_GEMS: "no"
         if: ${{ matrix.test_task == 'check' && matrix.skipped_tests != '' }}
         continue-on-error: ${{ matrix.continue-on-skipped_tests || false }}
-      - uses: k0kubun/action-slack@v2.0.0
+      - uses: ruby/action-slack@0bd85c72233cdbb6a0fe01d37aaeff1d21b5fce1 # v3.2.1
         with:
           payload: |
             {
@@ -89,7 +102,7 @@ jobs:
               "env": "${{ matrix.os }} / ${{ matrix.test_task }}${{ matrix.configure }}",
               "url": "https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}",
               "commit": "${{ github.sha }}",
-              "branch": "${{ github.ref }}".split('/').reverse()[0]
+              "branch": "${{ github.ref_name }}"
             }
         env:
           SLACK_WEBHOOK_URL: ${{ secrets.SIMPLER_ALERTS_URL }} # ruby-lang slack: ruby/simpler-alerts-bot
diff --git a/.github/workflows/mingw.yml b/.github/workflows/mingw.yml
index 020295baa1..0df917d3d8 100644
--- a/.github/workflows/mingw.yml
+++ b/.github/workflows/mingw.yml
@@ -3,12 +3,21 @@ on:
   push:
     paths-ignore:
       - 'doc/**'
+      - '**/man'
       - '**.md'
       - '**.rdoc'
       - '**/.document'
   pull_request:
     paths-ignore:
       - 'doc/**'
+      - '**/man'
+      - '**.md'
+      - '**.rdoc'
+      - '**/.document'
+  merge_group:
+    paths-ignore:
+      - 'doc/**'
+      - '**/man'
       - '**.md'
       - '**.rdoc'
       - '**/.document'
@@ -17,6 +26,9 @@ concurrency:
   group: ${{ github.workflow }} / ${{ startsWith(github.event_name, 'pull') && github.ref_name || github.sha }}
   cancel-in-progress: ${{ startsWith(github.event_name, 'pull') }}
 
+permissions:
+  contents: read
+
 # Notes:
 # Actions console encoding causes issues, see test-all & test-spec steps
 #
@@ -28,19 +40,16 @@ jobs:
       MSYSTEM: ${{ matrix.msystem }}
       MSYS2_ARCH: x86_64
       CHOST: "x86_64-w64-mingw32"
-      CFLAGS:   "-march=x86-64 -mtune=generic -O3 -pipe -fstack-protector-strong"
+      CFLAGS:   "-march=x86-64 -mtune=generic -O3 -pipe"
       CXXFLAGS: "-march=x86-64 -mtune=generic -O3 -pipe"
       CPPFLAGS: "-D_FORTIFY_SOURCE=2 -D__USE_MINGW_ANSI_STDIO=1 -DFD_SETSIZE=2048"
-      LDFLAGS:  "-pipe -fstack-protector-strong"
+      LDFLAGS:  "-pipe"
       UPDATE_UNICODE: "UNICODE_FILES=. UNICODE_PROPERTY_FILES=. UNICODE_AUXILIARY_FILES=. UNICODE_EMOJI_FILES=."
       GITPULLOPTIONS: --no-tags origin ${{github.ref}}
     strategy:
       matrix:
         include:
-          - msystem: "MINGW64"
-            base_ruby: 2.6
-            test_task: "check"
-            test-all-opts: "--name=!/TestObjSpace#test_reachable_objects_during_iteration/"
+          # To mitigate flakiness of MinGW CI, we test only one runtime that newer MSYS2 uses.
           - msystem: "UCRT64"
             base_ruby: head
             test_task: "check"
@@ -56,15 +65,15 @@ jobs:
           git config --global core.eol lf
           git config --global advice.detachedHead 0
           git config --global init.defaultBranch garbage
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           path: src
-      - uses: actions/cache@v3
+      - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
         with:
           path: src/.downloaded-cache
           key: downloaded-cache
       - name: Set up Ruby & MSYS2
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@13e7a03dc3ac6c3798f4570bfead2aed4d96abfb # v1.244.0
         with:
           ruby-version: ${{ matrix.base_ruby }}
       - name: set env
@@ -150,7 +159,7 @@ jobs:
           make ${{ StartsWith(matrix.test_task, 'spec/') && matrix.test_task || 'test-spec' }}
         if: ${{matrix.test_task == 'check' || matrix.test_task == 'test-spec' || StartsWith(matrix.test_task, 'spec/')}}
 
-      - uses: k0kubun/action-slack@v2.0.0
+      - uses: ruby/action-slack@0bd85c72233cdbb6a0fe01d37aaeff1d21b5fce1 # v3.2.1
         with:
           payload: |
             {
@@ -158,7 +167,7 @@ jobs:
               "env": "${{ github.workflow }} ${{ matrix.msystem }} / ${{ matrix.test_task }}",
               "url": "https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}",
               "commit": "${{ github.sha }}",
-              "branch": "${{ github.ref }}".split('/').reverse()[0]
+              "branch": "${{ github.ref_name }}"
             }
         env:
           SLACK_WEBHOOK_URL: ${{ secrets.SIMPLER_ALERTS_URL }} # ruby-lang slack: ruby/simpler-alerts-bot
diff --git a/.github/workflows/mjit-bindgen.yml b/.github/workflows/mjit-bindgen.yml
index 04c9ac4a9f..26f8a1b2aa 100644
--- a/.github/workflows/mjit-bindgen.yml
+++ b/.github/workflows/mjit-bindgen.yml
@@ -3,12 +3,21 @@ on:
   push:
     paths-ignore:
       - 'doc/**'
+      - '**/man'
       - '**.md'
       - '**.rdoc'
       - '**/.document'
   pull_request:
     paths-ignore:
       - 'doc/**'
+      - '**/man'
+      - '**.md'
+      - '**.rdoc'
+      - '**/.document'
+  merge_group:
+    paths-ignore:
+      - 'doc/**'
+      - '**/man'
       - '**.md'
       - '**.rdoc'
       - '**/.document'
@@ -17,6 +26,9 @@ concurrency:
   group: ${{ github.workflow }} / ${{ startsWith(github.event_name, 'pull') && github.ref_name || github.sha }}
   cancel-in-progress: ${{ startsWith(github.event_name, 'pull') }}
 
+permissions:
+  contents: read
+
 jobs:
   make:
     strategy:
@@ -24,9 +36,7 @@ jobs:
         include:
           - task: mjit-bindgen
       fail-fast: false
-    env:
-      SETARCH: ${{ matrix.arch && format('setarch {0}', matrix.arch) }}
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-22.04
     if: ${{ !contains(github.event.head_commit.message, '[DOC]') && !contains(github.event.pull_request.labels.*.name, 'Documentation') }}
     steps:
       - run: mkdir build
@@ -35,28 +45,28 @@ jobs:
         run: |
           echo "GNUMAKEFLAGS=-j$((1 + $(nproc --all)))" >> $GITHUB_ENV
       - name: Install libraries
-        env:
-          arch: ${{ matrix.arch }}
         run: |
           set -x
-          arch=${arch:+:${arch/i[3-6]86/i386}}
-          ${arch:+sudo dpkg --add-architecture ${arch#:}}
           sudo apt-get update -q || :
           sudo apt-get install --no-install-recommends -q -y \
-          ${arch:+cross}build-essential${arch/:/-} \
-          libssl-dev${arch} libyaml-dev${arch} libreadline6-dev${arch} \
-          zlib1g-dev${arch} libncurses5-dev${arch} libffi-dev${arch} \
-          libclang1-10${arch} \
-          bison autoconf ruby
-          sudo apt-get install -q -y pkg-config${arch} || :
+          build-essential \
+          libssl-dev libyaml-dev libreadline6-dev \
+          zlib1g-dev libncurses5-dev libffi-dev \
+          libclang1-14 \
+          bison autoconf
+          sudo apt-get install -q -y pkg-config || :
+      - name: Set up Ruby
+        uses: ruby/setup-ruby@13e7a03dc3ac6c3798f4570bfead2aed4d96abfb # v1.244.0
+        with:
+          ruby-version: '3.1'
       - name: git config
         run: |
           git config --global advice.detachedHead 0
           git config --global init.defaultBranch garbage
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           path: src
-      - uses: actions/cache@v3
+      - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
         with:
           path: src/.downloaded-cache
           key: downloaded-cache
@@ -68,18 +78,14 @@ jobs:
       - run: ./autogen.sh
         working-directory: src
       - name: Run configure
-        env:
-          arch: ${{ matrix.arch }}
-        run: >-
-          $SETARCH ../src/configure -C --disable-install-doc --prefix=$(pwd)/install --enable-yjit=dev_nodebug
-          ${arch:+--target=$arch-$OSTYPE --host=$arch-$OSTYPE}
-      - run: $SETARCH make incs
-      - run: $SETARCH make
-      - run: $SETARCH make install
-      - run: $SETARCH make ${{ matrix.task }}
+        run: ../src/configure -C --disable-install-doc --prefix=$(pwd)/install --enable-yjit=dev_nodebug
+      - run: make incs
+      - run: make
+      - run: make install
+      - run: make ${{ matrix.task }}
       - run: git diff --exit-code
         working-directory: src
-      - uses: k0kubun/action-slack@v2.0.0
+      - uses: ruby/action-slack@0bd85c72233cdbb6a0fe01d37aaeff1d21b5fce1 # v3.2.1
         with:
           payload: |
             {
@@ -87,7 +93,7 @@ jobs:
               "env": "${{ matrix.os }} / ${{ matrix.test_task }}${{ matrix.configure }}",
               "url": "https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}",
               "commit": "${{ github.sha }}",
-              "branch": "${{ github.ref }}".split('/').reverse()[0]
+              "branch": "${{ github.ref_name }}"
             }
         env:
           SLACK_WEBHOOK_URL: ${{ secrets.SIMPLER_ALERTS_URL }} # ruby-lang slack: ruby/simpler-alerts-bot
diff --git a/.github/workflows/mjit.yml b/.github/workflows/mjit.yml
index b5065288c7..6f7181489a 100644
--- a/.github/workflows/mjit.yml
+++ b/.github/workflows/mjit.yml
@@ -3,32 +3,47 @@ on:
   push:
     paths-ignore:
       - 'doc/**'
+      - '**/man'
       - '**.md'
       - '**.rdoc'
       - '**/.document'
   pull_request:
     paths-ignore:
       - 'doc/**'
+      - '**/man'
       - '**.md'
       - '**.rdoc'
       - '**/.document'
+      - '**.[1-8]'
+      - '**.ronn'
+  merge_group:
+    paths-ignore:
+      - 'doc/**'
+      - '**.md'
+      - '**.rdoc'
+      - '**/.document'
+      - '**.[1-8]'
+      - '**.ronn'
 
 concurrency:
   group: ${{ github.workflow }} / ${{ startsWith(github.event_name, 'pull') && github.ref_name || github.sha }}
   cancel-in-progress: ${{ startsWith(github.event_name, 'pull') }}
 
+permissions:
+  contents: read
+
 jobs:
   make:
     strategy:
       matrix:
-        test_task: [ "check" ] # to make job names consistent
-        jit_opts: [ "--mjit", "--mjit-wait" ]
+        test_task: [check] # to make job names consistent
+        mjit_opts: [--mjit-wait]
       fail-fast: false
     runs-on: ubuntu-latest
     if: ${{ !contains(github.event.head_commit.message, '[DOC]') && !contains(github.event.pull_request.labels.*.name, 'Documentation') }}
     env:
       TESTOPTS: '-q --tty=no'
-      RUN_OPTS: '--disable-gems ${{ matrix.jit_opts }} --mjit-debug=-ggdb3'
+      RUN_OPTS: '--disable-gems ${{ matrix.mjit_opts }} --mjit-debug=-ggdb3'
       GITPULLOPTIONS: --no-tags origin ${{github.ref}}
     steps:
       - run: mkdir build
@@ -42,10 +57,10 @@ jobs:
         run: |
           git config --global advice.detachedHead 0
           git config --global init.defaultBranch garbage
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           path: src
-      - uses: actions/cache@v3
+      - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
         with:
           path: src/.downloaded-cache
           key: downloaded-cache
@@ -64,31 +79,30 @@ jobs:
       - run: make incs
       - run: make
       - run: sudo make -s install
-      - run: sudo apt-get install gdb # used by test / test-all failure
       - name: Run test
         run: |
-          ulimit -c unlimited
+          unset GNUMAKEFLAGS
           make -s test RUN_OPTS="$RUN_OPTS"
         timeout-minutes: 60
-      - name: Run test-all
-        run: |
-          ulimit -c unlimited
-          make -s test-all RUN_OPTS="$RUN_OPTS"
-        timeout-minutes: 60
+      # - name: Run test-all
+      #   run: |
+      #     ulimit -c unlimited
+      #     make -s test-all RUN_OPTS="$RUN_OPTS"
+      #   timeout-minutes: 60
       - name: Run test-spec
         run: |
-          ulimit -c unlimited
+          unset GNUMAKEFLAGS
           make -s test-spec RUN_OPTS="$RUN_OPTS"
         timeout-minutes: 60
-      - uses: k0kubun/action-slack@v2.0.0
+      - uses: ruby/action-slack@0bd85c72233cdbb6a0fe01d37aaeff1d21b5fce1 # v3.2.1
         with:
           payload: |
             {
               "ci": "GitHub Actions",
-              "env": "${{ github.workflow }} / ${{ matrix.test_task }} ${{ matrix.jit_opts }}",
+              "env": "${{ github.workflow }} / ${{ matrix.test_task }} ${{ matrix.mjit_opts }}",
               "url": "https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}",
               "commit": "${{ github.sha }}",
-              "branch": "${{ github.ref }}".split('/').reverse()[0]
+              "branch": "${{ github.ref_name }}"
             }
         env:
           SLACK_WEBHOOK_URL: ${{ secrets.SIMPLER_ALERTS_URL }} # ruby-lang slack: ruby/simpler-alerts-bot
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
new file mode 100644
index 0000000000..5d4474d978
--- /dev/null
+++ b/.github/workflows/publish.yml
@@ -0,0 +1,18 @@
+name: Start release workflow
+on:
+  push:
+    tags:
+      - '*'
+
+jobs:
+  notify:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Build release package
+        run: |
+          curl -L -X POST \
+            -H "Authorization: Bearer ${{ secrets.MATZBOT_GITHUB_WORKFLOW_TOKEN }}" \
+            -H "Accept: application/vnd.github+json" \
+            -H "X-GitHub-Api-Version: 2022-11-28" \
+            https://api.github.com/repos/ruby/actions/dispatches \
+            -d '{"event_type": "${{ github.ref }}"}'
diff --git a/.github/workflows/scorecards.yml b/.github/workflows/scorecards.yml
new file mode 100644
index 0000000000..c12a95362d
--- /dev/null
+++ b/.github/workflows/scorecards.yml
@@ -0,0 +1,72 @@
+# This workflow uses actions that are not certified by GitHub. They are provided
+# by a third-party and are governed by separate terms of service, privacy
+# policy, and support documentation.
+
+name: Scorecards supply-chain security
+on:
+  # For Branch-Protection check. Only the default branch is supported. See
+  # https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection
+  branch_protection_rule:
+  # To guarantee Maintained check is occasionally updated. See
+  # https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained
+  schedule:
+    - cron: '22 4 * * 2'
+  push:
+    branches: [ "master" ]
+
+# Declare default permissions as read only.
+permissions: read-all
+
+jobs:
+  analysis:
+    name: Scorecards analysis
+    runs-on: ubuntu-latest
+    permissions:
+      # Needed to upload the results to code-scanning dashboard.
+      security-events: write
+      # Needed to publish results and get a badge (see publish_results below).
+      id-token: write
+      # Uncomment the permissions below if installing in a private repository.
+      # contents: read
+      # actions: read
+
+    steps:
+      - name: "Checkout code"
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+
+      - name: "Run analysis"
+        uses: ossf/scorecard-action@ea651e62978af7915d09fe2e282747c798bf2dab # v2.4.1
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          # (Optional) Read-only PAT token. Uncomment the `repo_token` line below if:
+          # - you want to enable the Branch-Protection check on a *public* repository, or
+          # - you are installing Scorecards on a *private* repository
+          # To create the PAT, follow the steps in https://github.com/ossf/scorecard-action#authentication-with-pat.
+          repo_token: ${{ secrets.SCORECARD_READ_TOKEN }}
+
+          # Public repositories:
+          #   - Publish results to OpenSSF REST API for easy access by consumers
+          #   - Allows the repository to include the Scorecard badge.
+          #   - See https://github.com/ossf/scorecard-action#publishing-results.
+          # For private repositories:
+          #   - `publish_results` will always be set to `false`, regardless
+          #     of the value entered here.
+          publish_results: true
+
+      # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
+      # format to the repository Actions tab.
+      - name: "Upload artifact"
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: SARIF file
+          path: results.sarif
+          retention-days: 5
+
+      # Upload the results to GitHub's code scanning dashboard.
+      - name: "Upload to code-scanning"
+        uses: github/codeql-action/upload-sarif@959cbb7472c4d4ad70cdfe6f4976053fe48ab394 # v2.1.27
+        with:
+          sarif_file: results.sarif
diff --git a/.github/workflows/spec_guards.yml b/.github/workflows/spec_guards.yml
index 7bffe25bb2..4521195a2b 100644
--- a/.github/workflows/spec_guards.yml
+++ b/.github/workflows/spec_guards.yml
@@ -2,47 +2,61 @@ name: Rubyspec Version Guards Check
 
 on:
   push:
-    paths-ignore:
-      - 'doc/**'
-      - '**.md'
-      - '**.rdoc'
-      - '**/.document'
+    paths:
+      - 'spec/**'
+      - '!spec/*.md'
   pull_request:
-    paths-ignore:
-      - 'doc/**'
-      - '**.md'
-      - '**.rdoc'
-      - '**/.document'
+    paths:
+      - 'spec/**'
+      - '!spec/*.md'
+  merge_group:
 
 concurrency:
   group: ${{ github.workflow }} / ${{ startsWith(github.event_name, 'pull') && github.ref_name || github.sha }}
   cancel-in-progress: ${{ startsWith(github.event_name, 'pull') }}
 
+permissions:
+  contents: read
+
 jobs:
   rubyspec:
     name: Rubyspec
-    runs-on: ubuntu-20.04
-    if: ${{ !contains(github.event.head_commit.message, '[DOC]') && !contains(github.event.pull_request.labels.*.name, 'Documentation') }}
+
+    runs-on: ubuntu-22.04
+
+    if: >-
+      ${{!(false
+      || contains(github.event.head_commit.message, '[DOC]')
+      || contains(github.event.head_commit.message, 'Document')
+      || contains(github.event.pull_request.title, '[DOC]')
+      || contains(github.event.pull_request.title, 'Document')
+      || contains(github.event.pull_request.labels.*.name, 'Document')
+      || (github.event_name == 'push' && github.actor == 'dependabot[bot]')
+      )}}
+
     strategy:
       matrix:
         # Specs from ruby/spec should still run on all supported Ruby versions.
         # This also ensures the needed ruby_version_is guards are there, see spec/README.md.
         ruby:
-          - ruby-2.7
           - ruby-3.1
+          - ruby-3.2
 
     steps:
-      - uses: actions/checkout@v3
-      - uses: ruby/setup-ruby@v1
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - uses: ruby/setup-ruby@13e7a03dc3ac6c3798f4570bfead2aed4d96abfb # v1.244.0
         with:
           ruby-version: ${{ matrix.ruby }}
           bundler: none
+
       - run: gem install webrick
+
       - run: ruby ../mspec/bin/mspec
         working-directory: spec/ruby
         env:
           CHECK_LEAKS: true
-      - uses: k0kubun/action-slack@v2.0.0
+      - uses: ruby/action-slack@0bd85c72233cdbb6a0fe01d37aaeff1d21b5fce1 # v3.2.1
         with:
           payload: |
             {
@@ -50,8 +64,8 @@ jobs:
               "env": "${{ github.workflow }} / rubyspec @ ${{ matrix.ruby }}",
               "url": "https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}",
               "commit": "${{ github.sha }}",
-              "branch": "${{ github.ref }}".split('/').reverse()[0]
+              "branch": "${{ github.ref_name }}"
             }
         env:
           SLACK_WEBHOOK_URL: ${{ secrets.SIMPLER_ALERTS_URL }} # ruby-lang slack: ruby/simpler-alerts-bot
-        if: ${{ failure() && github.event_name == 'push' }}
+        if: ${{ failure() }}
diff --git a/.github/workflows/ubuntu.yml b/.github/workflows/ubuntu.yml
index a1818182a3..4fbca1170e 100644
--- a/.github/workflows/ubuntu.yml
+++ b/.github/workflows/ubuntu.yml
@@ -3,12 +3,21 @@ on:
   push:
     paths-ignore:
       - 'doc/**'
+      - '**/man'
       - '**.md'
       - '**.rdoc'
       - '**/.document'
   pull_request:
     paths-ignore:
       - 'doc/**'
+      - '**/man'
+      - '**.md'
+      - '**.rdoc'
+      - '**/.document'
+  merge_group:
+    paths-ignore:
+      - 'doc/**'
+      - '**/man'
       - '**.md'
       - '**.rdoc'
       - '**/.document'
@@ -17,6 +26,9 @@ concurrency:
   group: ${{ github.workflow }} / ${{ startsWith(github.event_name, 'pull') && github.ref_name || github.sha }}
   cancel-in-progress: ${{ startsWith(github.event_name, 'pull') }}
 
+permissions:
+  contents: read
+
 jobs:
   make:
     strategy:
@@ -34,7 +46,6 @@ jobs:
           - test_task: check
             configure: "--enable-shared --enable-load-relative"
           - test_task: test-all TESTS=--repeat-count=2
-          - test_task: test-syntax-suggest
           - test_task: test-bundler-parallel
           - test_task: test-bundled-gems
       fail-fast: false
@@ -42,7 +53,7 @@ jobs:
       GITPULLOPTIONS: --no-tags origin ${{github.ref}}
       RUBY_DEBUG: ci
       SETARCH: ${{ matrix.arch && format('setarch {0}', matrix.arch) }}
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-22.04
     if: ${{ !contains(github.event.head_commit.message, '[DOC]') && !contains(github.event.pull_request.labels.*.name, 'Documentation') }}
     steps:
       - run: mkdir build
@@ -68,10 +79,10 @@ jobs:
         run: |
           git config --global advice.detachedHead 0
           git config --global init.defaultBranch garbage
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           path: src
-      - uses: actions/cache@v3
+      - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
         with:
           path: src/.downloaded-cache
           key: downloaded-cache
@@ -116,7 +127,7 @@ jobs:
           TESTS: ${{ matrix.skipped_tests }}
         if: ${{ matrix.test_task == 'check' && matrix.skipped_tests != '' }}
         continue-on-error: ${{ matrix.continue-on-skipped_tests || false }}
-      - uses: k0kubun/action-slack@v2.0.0
+      - uses: ruby/action-slack@0bd85c72233cdbb6a0fe01d37aaeff1d21b5fce1 # v3.2.1
         with:
           payload: |
             {
@@ -124,7 +135,7 @@ jobs:
               "env": "${{ github.workflow }} / ${{ matrix.test_task }} ${{ matrix.configure }}${{ matrix.arch }}",
               "url": "https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}",
               "commit": "${{ github.sha }}",
-              "branch": "${{ github.ref }}".split('/').reverse()[0]
+              "branch": "${{ github.ref_name }}"
             }
         env:
           SLACK_WEBHOOK_URL: ${{ secrets.SIMPLER_ALERTS_URL }} # ruby-lang slack: ruby/simpler-alerts-bot
diff --git a/.github/workflows/wasm.yml b/.github/workflows/wasm.yml
author	Alan Wu <XrXr@users.noreply.github.com>	2022-11-25 13:13:09 -0500
committer	Alan Wu <XrXr@users.noreply.github.com>	2022-11-25 17:15:24 -0500
commit	1d64a5a7c09d1029508b6b3cb3d04e5a939bc8f8 (patch)
tree	aa447cb2b46da4ac5b5f7ebc9b8620c4b9f0214a /array.c
parent	790cf4b6d0475614afb127b416e87cfa39044d67 (diff)