10750 files changed, 1512722 insertions, 865915 deletions

diff --git a/.document b/.document
index 0e0969a6d3..753d6f9892 100644
--- a/.document
+++ b/.document
@@ -10,16 +10,31 @@
 # prelude
 prelude.rb
 rbconfig.rb
+
 array.rb
 ast.rb
 dir.rb
 gc.rb
-integer.rb
+hash.rb
 io.rb
 kernel.rb
+marshal.rb
+numeric.rb
+nilclass.rb
 pack.rb
+pathname_builtin.rb
+ractor.rb
+string.rb
+symbol.rb
+timev.rb
+thread_sync.rb
 trace_point.rb
 warning.rb
+yjit.rb
+zjit.rb
+
+# Errno::*
+known_errors.inc
 
 # the lib/ directory (which has its own .document file)
 lib
@@ -27,6 +42,9 @@ lib
 # and some of the ext/ directory (which has its own .document file)
 ext
 
+# For `prism`, ruby code is in lib and c in the prism folder
+prism
+
 # rdoc files
 NEWS.md
 
@@ -35,11 +53,7 @@ README.ja.md
 
 COPYING
 COPYING.ja
-CONTRIBUTING.md
 
 LEGAL
 
-# win32/README.win32 linked from README.md
-win32
-
 doc
diff --git a/.gdbinit b/.gdbinit
index 714d7bee10..4457f6f12b 100644
--- a/.gdbinit
+++ b/.gdbinit
@@ -1,23 +1,7 @@
-set startup-with-shell off
-
-define hook-run
-  set $color_type = 0
-  set $color_highlite = 0
-  set $color_end = 0
-end
-
 define ruby_gdb_init
-  if !$color_type
-    set $color_type = "\033[31m"
-  end
-  if !$color_highlite
-    set $color_highlite = "\033[36m"
-  end
-  if !$color_end
-    set $color_end = "\033[m"
-  end
-  if ruby_dummy_gdb_enums.special_consts
-  end
+  init-if-undefined $color_type = "\033[31m"
+  init-if-undefined $color_highlite = "\033[36m"
+  init-if-undefined $color_end = "\033[m"
 end
 
 # set prompt \033[36m(gdb)\033[m\040
@@ -67,7 +51,7 @@ define rp
     printf "%sT_OBJECT%s: ", $color_type, $color_end
     print ((struct RObject *)($arg0))->basic
     if ($flags & ROBJECT_EMBED)
-      print/x *((VALUE*)((struct RObject*)($arg0))->as.ary) @ (ROBJECT_EMBED_LEN_MAX+0)
+      print/x *((VALUE*)((struct RObject*)($arg0))->as.ary) @ (RSHAPE_CAPACITY(rb_obj_shape_id($arg0)))
     else
       print (((struct RObject *)($arg0))->as.heap)
       if (((struct RObject*)($arg0))->as.heap.numiv) > 0
@@ -99,13 +83,11 @@ define rp
     set $regsrc = ((struct RRegexp*)($arg0))->src
     set $rsflags = ((struct RBasic*)$regsrc)->flags
     printf "%sT_REGEXP%s: ", $color_type, $color_end
-    set $len = ($rsflags & RUBY_FL_USER1) ? \
-            ((struct RString*)$regsrc)->as.heap.len : \
-            (($rsflags & (RUBY_FL_USER2|RUBY_FL_USER3|RUBY_FL_USER4|RUBY_FL_USER5|RUBY_FL_USER6)) >> RUBY_FL_USHIFT+2)
+    set $len = ((struct RString*)($arg0))->len
     set print address off
     output *(char *)(($rsflags & RUBY_FL_USER1) ? \
-	    ((struct RString*)$regsrc)->as.heap.ptr : \
-	    ((struct RString*)$regsrc)->as.ary) @ $len
+            ((struct RString*)$regsrc)->as.heap.ptr : \
+            ((struct RString*)$regsrc)->as.embed.ary) @ $len
     set print address on
     printf " len:%ld ", $len
     if $flags & RUBY_FL_USER6
@@ -126,26 +108,26 @@ define rp
       printf "%sT_ARRAY%s: len=%ld ", $color_type, $color_end, $len
       printf "(embed) "
       if ($len == 0)
-	printf "{(empty)} "
+        printf "{(empty)} "
       else
-	print/x *((VALUE*)((struct RArray*)($arg0))->as.ary) @ $len
-	printf " "
+        print/x *((VALUE*)((struct RArray*)($arg0))->as.ary) @ $len
+        printf " "
       end
     else
       set $len = ((struct RArray*)($arg0))->as.heap.len
       printf "%sT_ARRAY%s: len=%ld ", $color_type, $color_end, $len
       if ($flags & RUBY_FL_USER2)
-	printf "(shared) shared="
-	output/x ((struct RArray*)($arg0))->as.heap.aux.shared_root
-	printf " "
+        printf "(shared) shared="
+        output/x ((struct RArray*)($arg0))->as.heap.aux.shared_root
+        printf " "
       else
-	printf "(ownership) capa=%ld ", ((struct RArray*)($arg0))->as.heap.aux.capa
+        printf "(ownership) capa=%ld ", ((struct RArray*)($arg0))->as.heap.aux.capa
       end
       if ($len == 0)
-	printf "{(empty)} "
+        printf "{(empty)} "
       else
-	print/x *((VALUE*)((struct RArray*)($arg0))->as.heap.ptr) @ $len
-	printf " "
+        print/x *((VALUE*)((struct RArray*)($arg0))->as.heap.ptr) @ $len
+        printf " "
       end
     end
     print (struct RArray *)($arg0)
@@ -157,13 +139,15 @@ define rp
   if ($flags & RUBY_T_MASK) == RUBY_T_HASH
     printf "%sT_HASH%s: ", $color_type, $color_end,
     if (((struct RHash *)($arg0))->basic.flags & RHASH_ST_TABLE_FLAG)
-      printf "st len=%ld ", ((struct RHash *)($arg0))->as.st->num_entries
+      set $st = (struct st_table *)((uintptr_t)($arg0) + sizeof(struct RHash))
+      printf "st len=%ld ", $st->num_entries
+      print $st
     else
       printf "li len=%ld bound=%ld ", \
         ((((struct RHash *)($arg0))->basic.flags & RHASH_AR_TABLE_SIZE_MASK) >> RHASH_AR_TABLE_SIZE_SHIFT), \
         ((((struct RHash *)($arg0))->basic.flags & RHASH_AR_TABLE_BOUND_MASK) >> RHASH_AR_TABLE_BOUND_SHIFT)
+	print (struct ar_table_struct *)((uintptr_t)($arg0) + sizeof(struct RHash))
     end
-    print (struct RHash *)($arg0)
   else
   if ($flags & RUBY_T_MASK) == RUBY_T_STRUCT
     set $len = (($flags & (RUBY_FL_USER1|RUBY_FL_USER2)) ? \
@@ -201,12 +185,14 @@ define rp
     print (struct RBasic *)($arg0)
   else
   if ($flags & RUBY_T_MASK) == RUBY_T_DATA
-    if ((struct RTypedData *)($arg0))->typed_flag == 1
-      printf "%sT_DATA%s(%s): ", $color_type, $color_end, ((struct RTypedData *)($arg0))->type->wrap_struct_name
-      print (struct RTypedData *)($arg0)
+    set $data = (struct RTypedData *)($arg0)
+    set $type = (const rb_data_type_t *)($data->type & ~1)
+    printf "%sT_DATA%s(%s): ", $color_type, $color_end, $type->wrap_struct_name
+    print *$type
+    if ($data->type & 1)
+      print (void *)&$data->data
     else
-      printf "%sT_DATA%s: ", $color_type, $color_end
-      print (struct RData *)($arg0)
+      print $data
     end
   else
   if ($flags & RUBY_T_MASK) == RUBY_T_MATCH
@@ -265,6 +251,10 @@ define rp
     printf "%sT_ZOMBIE%s: ", $color_type, $color_end
     print (struct RData *)($arg0)
   else
+  if ($flags & RUBY_T_MASK) == RUBY_T_MOVED
+    printf "%sT_MOVED%s: ", $color_type, $color_end
+    print *(struct RMoved *)$arg0
+  else
     printf "%sunknown%s: ", $color_type, $color_end
     print (struct RBasic *)($arg0)
   end
@@ -300,6 +290,7 @@ define rp
   end
   end
   end
+  end
 end
 document rp
   Print a Ruby's VALUE.
@@ -435,13 +426,11 @@ end
 
 define output_string
   set $flags = ((struct RBasic*)($arg0))->flags
-  set $len = ($flags & RUBY_FL_USER1) ? \
-          ((struct RString*)($arg0))->as.heap.len : \
-          (($flags & (RUBY_FL_USER2|RUBY_FL_USER3|RUBY_FL_USER4|RUBY_FL_USER5|RUBY_FL_USER6)) >> RUBY_FL_USHIFT+2)
+  set $len = ((struct RString*)($arg0))->len
   if $len > 0
     output *(char *)(($flags & RUBY_FL_USER1) ? \
-	    ((struct RString*)($arg0))->as.heap.ptr : \
-	    ((struct RString*)($arg0))->as.ary) @ $len
+            ((struct RString*)($arg0))->as.heap.ptr : \
+            ((struct RString*)($arg0))->as.embed.ary) @ $len
   else
     output ""
   end
@@ -449,13 +438,11 @@ end
 
 define print_string
   set $flags = ((struct RBasic*)($arg0))->flags
-  set $len = ($flags & RUBY_FL_USER1) ? \
-          ((struct RString*)($arg0))->as.heap.len : \
-          (($flags & (RUBY_FL_USER2|RUBY_FL_USER3|RUBY_FL_USER4|RUBY_FL_USER5|RUBY_FL_USER6)) >> RUBY_FL_USHIFT+2)
+  set $len = ((struct RString*)($arg0))->len
   if $len > 0
     printf "%s", *(char *)(($flags & RUBY_FL_USER1) ? \
-	    ((struct RString*)($arg0))->as.heap.ptr : \
-	    ((struct RString*)($arg0))->as.ary) @ $len
+            ((struct RString*)($arg0))->as.heap.ptr : \
+            ((struct RString*)($arg0))->as.embed.ary) @ $len
   end
 end
 
@@ -538,14 +525,14 @@ document rp_bignum
 end
 
 define rp_class
+  set $class_and_classext = (struct RClass_and_rb_classext_t *)($arg0)
   printf "(struct RClass *) %p", (void*)$arg0
-  if ((struct RClass *)($arg0))->ptr.origin_ != $arg0
-    printf " -> %p", ((struct RClass *)($arg0))->ptr.origin_
+  if $class_and_classext->classext->origin_ != (VALUE)$arg0
+    printf " -> %p", $class_and_classext->classext->origin_
   end
   printf "\n"
   rb_classname $arg0
-  print/x *(struct RClass *)($arg0)
-  print *((struct RClass *)($arg0))->ptr
+  print/x *$class_and_classext
 end
 document rp_class
   Print the content of a Class/Module.
@@ -684,11 +671,6 @@ define nd_stts
 end
 
 
-define nd_entry
-  printf "%su3.entry%s: ", $color_highlite, $color_end
-  p ($arg0).u3.entry
-end
-
 define nd_vid
   printf "%su1.id%s: ", $color_highlite, $color_end
   p ($arg0).u1.id
@@ -863,22 +845,22 @@ define rb_numtable_entry
     set $rb_numtable_p = $rb_numtable_tbl->as.packed.bins
     while $rb_numtable_p && $rb_numtable_p < $rb_numtable_tbl->as.packed.bins+$rb_numtable_tbl->num_entries
       if $rb_numtable_p.k == $rb_numtable_id
-	set $rb_numtable_key = $rb_numtable_p.k
-	set $rb_numtable_rec = $rb_numtable_p.v
-	set $rb_numtable_p = 0
+        set $rb_numtable_key = $rb_numtable_p.k
+        set $rb_numtable_rec = $rb_numtable_p.v
+        set $rb_numtable_p = 0
       else
-	set $rb_numtable_p = $rb_numtable_p + 1
+        set $rb_numtable_p = $rb_numtable_p + 1
       end
     end
   else
     set $rb_numtable_p = $rb_numtable_tbl->as.big.bins[st_numhash($rb_numtable_id) % $rb_numtable_tbl->num_bins]
     while $rb_numtable_p
       if $rb_numtable_p->key == $rb_numtable_id
-	set $rb_numtable_key = $rb_numtable_p->key
-	set $rb_numtable_rec = $rb_numtable_p->record
-	set $rb_numtable_p = 0
+        set $rb_numtable_key = $rb_numtable_p->key
+        set $rb_numtable_rec = $rb_numtable_p->record
+        set $rb_numtable_p = 0
       else
-	set $rb_numtable_p = $rb_numtable_p->next
+        set $rb_numtable_p = $rb_numtable_p->next
       end
     end
   end
@@ -916,10 +898,10 @@ document rb_method_entry
 end
 
 define rb_classname
-  # up to 128bit int
-  set $rb_classname = rb_mod_name($arg0)
-  if $rb_classname != RUBY_Qnil
-    rp $rb_classname
+  set $rb_classname = ((struct RClass_and_rb_classext_t*)$arg0)->classext->classpath
+  if $rb_classname != RUBY_Qfalse
+    print_string $rb_classname
+    printf "\n"
   else
     echo anonymous class/module\n
   end
@@ -956,7 +938,7 @@ define iseq
       set $operand_size = ((INSN*)($arg0))->operand_size
       set $operands = ((INSN*)($arg0))->operands
       while $i < $operand_size
-	rp $operands[$i++]
+        rp $operands[$i++]
       end
     end
   end
@@ -974,8 +956,8 @@ end
 
 define rb_ps_vm
   print $ps_vm = (rb_vm_t*)$arg0
-  set $ps_thread_ln = $ps_vm->living_threads.n.next
-  set $ps_thread_ln_last = $ps_vm->living_threads.n.prev
+  set $ps_thread_ln      = $ps_vm->ractor.main_ractor.threads.set.n.next
+  set $ps_thread_ln_last = $ps_vm->ractor.main_ractor.threads.set.n.prev
   while 1
     set $ps_thread_th = (rb_thread_t *)$ps_thread_ln
     set $ps_thread = (VALUE)($ps_thread_th->self)
@@ -992,7 +974,7 @@ end
 
 define print_lineno
   set $cfp = $arg0
-  set $iseq = $cfp->iseq
+  set $iseq = rb_get_cfp_iseq($cfp)
   set $pos = $cfp->pc - $iseq->body->iseq_encoded
   if $pos != 0
     set $pos = $pos - 1
@@ -1073,7 +1055,7 @@ define print_id
   else
     set $serial = (rb_id_serial_t)$id
   end
-  if $serial && $serial <= ruby_global_symbols.last_id
+  if $serial && $serial < ruby_global_symbols.next_id
     set $idx = $serial / ID_ENTRY_UNIT
     set $ids = (struct RArray *)ruby_global_symbols.ids
     set $flags = $ids->basic.flags
@@ -1096,12 +1078,12 @@ define print_id
           set $aryptr = $ary->as.heap.ptr
           set $arylen = $ary->as.heap.len
         end
-        set $result = $aryptr[($serial % ID_ENTRY_UNIT) * ID_ENTRY_SIZE + $t]
-	if $result != RUBY_Qnil
+        set $result = $aryptr[($serial % ID_ENTRY_UNIT) + $t]
+        if $result != RUBY_Qnil
           print_string $result
-	else
-	  echo undef
-	end
+        else
+          echo undef
+        end
       end
     end
   end
@@ -1126,20 +1108,21 @@ define rb_ps_thread
   set $ps_thread = (struct RTypedData*)$arg0
   set $ps_thread_th = (rb_thread_t*)$ps_thread->data
   printf "* #<Thread:%p rb_thread_t:%p native_thread:%p>\n", \
-    $ps_thread, $ps_thread_th, $ps_thread_th->thread_id
+    $ps_thread, $ps_thread_th, $ps_thread_th->nt
   set $cfp = $ps_thread_th->ec->cfp
   set $cfpend = (rb_control_frame_t *)($ps_thread_th->ec->vm_stack + $ps_thread_th->ec->vm_stack_size)-1
   while $cfp < $cfpend
-    if $cfp->iseq
-      if !((VALUE)$cfp->iseq & RUBY_IMMEDIATE_MASK) && (((imemo_ifunc << RUBY_FL_USHIFT) | RUBY_T_IMEMO)==$cfp->iseq->flags & ((RUBY_IMEMO_MASK << RUBY_FL_USHIFT) | RUBY_T_MASK))
+    if $cfp->_iseq
+      set $iseq = rb_get_cfp_iseq($cfp)
+      if !((VALUE)$iseq & RUBY_IMMEDIATE_MASK) && (((imemo_ifunc << RUBY_FL_USHIFT) | RUBY_T_IMEMO)==$iseq->flags & ((RUBY_IMEMO_MASK << RUBY_FL_USHIFT) | RUBY_T_MASK))
         printf "%d:ifunc ", $cfpend-$cfp
         set print symbol-filename on
-        output/a $cfp->iseq.body
+        output/a $iseq.body
         set print symbol-filename off
         printf "\n"
       else
       if $cfp->pc
-        set $location = $cfp->iseq->body->location
+        set $location = $iseq->body->location
         printf "%d:", $cfpend-$cfp
         print_pathobj $location.pathobj
         printf ":"
@@ -1274,9 +1257,9 @@ document rb_count_objects
   Counts all objects grouped by type.
 end
 
-# Details: https://bugs.ruby-lang.org/projects/ruby-master/wiki/MachineInstructionsTraceWithGDB
+# Details: https://github.com/ruby/ruby/wiki/Machine-Instructions-Trace-with-GDB
 define trace_machine_instructions
-  set logging on
+  set logging enabled
   set height 0
   set width 0
   display/i $pc
@@ -1311,16 +1294,14 @@ define dump_node
   set $flags = ((struct RBasic*)($str))->flags
   printf "%s", (char *)(($flags & RUBY_FL_USER1) ? \
                         ((struct RString*)$str)->as.heap.ptr : \
-                        ((struct RString*)$str)->as.ary)
+                        ((struct RString*)$str)->as.embed.ary)
 end
 
 define print_flags
   printf "RUBY_FL_WB_PROTECTED: %s\n", ((struct RBasic*)($arg0))->flags & RUBY_FL_WB_PROTECTED ? "1" : "0"
-  printf "RUBY_FL_PROMOTED0   : %s\n", ((struct RBasic*)($arg0))->flags & RUBY_FL_PROMOTED0 ? "1" : "0"
-  printf "RUBY_FL_PROMOTED1   : %s\n", ((struct RBasic*)($arg0))->flags & RUBY_FL_PROMOTED1 ? "1" : "0"
+  printf "RUBY_FL_PROMOTED    : %s\n", ((struct RBasic*)($arg0))->flags & RUBY_FL_PROMOTED ? "1" : "0"
   printf "RUBY_FL_FINALIZE    : %s\n", ((struct RBasic*)($arg0))->flags & RUBY_FL_FINALIZE ? "1" : "0"
-  printf "RUBY_FL_TAINT       : %s\n", ((struct RBasic*)($arg0))->flags & RUBY_FL_TAINT ? "1" : "0"
-  printf "RUBY_FL_UNTRUSTED   : %s\n", ((struct RBasic*)($arg0))->flags & RUBY_FL_UNTRUSTED ? "1" : "0"
+  printf "RUBY_FL_SHAREABLE   : %s\n", ((struct RBasic*)($arg0))->flags & RUBY_FL_SHAREABLE ? "1" : "0"
   printf "RUBY_FL_EXIVAR      : %s\n", ((struct RBasic*)($arg0))->flags & RUBY_FL_EXIVAR ? "1" : "0"
   printf "RUBY_FL_FREEZE      : %s\n", ((struct RBasic*)($arg0))->flags & RUBY_FL_FREEZE ? "1" : "0"
 
@@ -1344,3 +1325,8 @@ define print_flags
   printf "RUBY_FL_USER17      : %s\n", ((struct RBasic*)($arg0))->flags & RUBY_FL_USER17 ? "1" : "0"
   printf "RUBY_FL_USER18      : %s\n", ((struct RBasic*)($arg0))->flags & RUBY_FL_USER18 ? "1" : "0"
 end
+
+source -s misc/gdb.py
+
+# Moved from beginning, since it fails on older gdbs
+set startup-with-shell off
diff --git a/.git-blame-ignore-revs b/.git-blame-ignore-revs
new file mode 100644
index 0000000000..d752612085
--- /dev/null
+++ b/.git-blame-ignore-revs
@@ -0,0 +1,54 @@
+# This is a file used by GitHub to ignore the following commits on `git blame`.
+#
+# You can also do the same thing in your local repository with:
+# $ git config --local blame.ignoreRevsFile .git-blame-ignore-revs
+
+# Expand tabs
+5b21e94bebed90180d8ff63dad03b8b948361089
+c5e9af9c9d890578182a21e7b71b50334cd5579e
+e63a2115f64433b21cb5dd67c5bf8b30f87ef293
+712ac99e4d0384a941c80a9f48f62943ba7d97c0
+d1474affa8e105bece209cc9d594bb0a989859e1
+2da92388b948821269b18d6b178a680f17e41750
+5062c0c621d887367af8a054e5e5d83d7ec57dd3
+
+# Indentation
+0e4bad888e605d424b9222ae0ca43f85c1634e5e
+61aa46c41648c6d1e9b0daa1a292de551fde78df
+
+# Enable Style/StringLiterals cop for RubyGems/Bundler
+d7ffd3fea402239b16833cc434404a7af82d44f3
+
+# [ruby/digest] Revert tab-expansion in external files
+48b09aae7ec5632209229dcc294dd0d75a93a17f
+8a65cf3b61c60e4cb886f59a73ff6db44364bfa9
+39dc9f9093901d40d2998653948d5da38b18ee2c
+
+# [ruby/io-nonblock] Revert tab expansion
+f28287d34c03f472ffe90ea262bdde9affd4b965
+0d842fecb4f75ab3b1d4097ebdb8e88f51558041
+4ba2c66761d6a293abdfba409241d31063cefd62
+
+# Make benchmark indentation consistent
+fc4acf8cae82e5196186d3278d831f2438479d91
+
+# Make prism_compile.c indentation consistent
+40b2c8e5e7e6e5f83cee9276dc9c1922a69292d6
+d2c5867357ed88eccc28c2b3bd4a46e206e7ff85
+
+# Miss-and-revived commits
+a0f7de814ae5c299d6ce99bed5fb308a05d50ba0
+d4e24021d39e1f80f0055b55d91f8d5f22e15084
+7a56c316418980b8a41fcbdc94067b2bda2ad112
+e90282be7ba1bc8e3119f6e1a2c80356ceb3f80a
+26a9e0b4e31f7b5a9cbd755e0a15823a8fa51bae
+2f53985da9ee593fe524d408256835667938c7d7
+bf01f6ae89a95d8f5572e050facfe311c8c28aaf
+7480cd8d37fd71a41ce12b759090051c7e14fb5a
+
+# Win32: EOL code of batch files
+23f9a0d655c4d405bb2397a147a1523436205486
+b839989fd22fef85e2af19de1bc83aa72a5b22bd
+
+# ZJIT cargo-insta snapshot raw string literals
+b78e0a6ddf7df8a7568ea71284f593423c739551
diff --git a/.gitattributes b/.gitattributes
index d0c2d266b4..f98c091e3f 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -1,8 +1,14 @@
 *.gemspec diff=ruby
 *.rb diff=ruby
+*.inc.rs linguist-generated=true
 bin svn-properties=svn:ignore=ruby
 bin/* diff=ruby
 tool/update-deps diff=ruby
 tool/make-snapshot diff=ruby
 tool/format-release diff=ruby
 tool/leaked-globals diff=ruby
+
+# To strip CR from the batch files, set the `diff.dos.textconv` filter
+# like as `git config diff.dos.textconv $'sed \'s/\r$//\''`.
+*.bat diff=dos
+*.cmd diff=dos
diff --git a/.github/actions/capiext/action.yml b/.github/actions/capiext/action.yml
new file mode 100644
index 0000000000..ed69c8ac5e
--- /dev/null
+++ b/.github/actions/capiext/action.yml
@@ -0,0 +1,86 @@
+name: rubyspec C-API extensions
+
+inputs:
+  builddir:
+    required: false
+    default: '.'
+  make:
+    required: false
+    default: 'make -s'
+
+outputs:
+  key:
+    value: >-
+      ${{
+      !steps.restore.outputs.cache-hit &&
+      github.ref == 'refs/heads/master' &&
+      steps.config.outputs.key
+      }}
+
+runs:
+  using: composite
+
+  steps:
+    - id: config
+      shell: bash
+      run: |
+        eval $(grep -e '^arch *=' -e '^ruby_version *=' -e '^DLEXT *=' Makefile |
+            sed 's/ *= */=/')
+        case "${ruby_version}" in
+        *+*) key=capiexts-${arch}-${ruby_version}-${{ hashFiles('src/spec/ruby/optional/capi/ext/*.[ch]') }};;
+        *)   key=;;
+        esac
+        echo version=$ruby_version >> $GITHUB_OUTPUT
+        echo key="$key" >> $GITHUB_OUTPUT
+        echo DLEXT=$DLEXT >> $GITHUB_OUTPUT
+      working-directory: ${{ inputs.builddir }}
+
+    - name: Restore previous CAPI extensions
+      uses: actions/cache/restore@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
+      id: cache
+      with:
+        path: ${{ inputs.builddir }}/spec/ruby/optional/capi/ext/
+        key: ${{ steps.config.outputs.key }}
+      if: ${{ steps.config.outputs.key }}
+
+    - name: Run test-spec with previous CAPI extension binaries
+      id: check
+      shell: bash
+      run: | # zizmor: ignore[template-injection]
+        touch spec/ruby/optional/capi/ext/*.$DLEXT
+        [ ! -f spec/ruby/optional/capi/ext/\*.$DLEXT ]
+        ${{ inputs.make }} SPECOPTS=optional/capi test-spec
+      env:
+        DLEXT: ${{ steps.config.outputs.DLEXT }}
+      working-directory: ${{ inputs.builddir }}
+      if: ${{ steps.cache.outputs.cache-hit }}
+
+    - name: Strip CAPI extensions
+      id: strip
+      shell: bash
+      run: |
+        rm -f spec/ruby/optional/capi/ext/*.c
+        [ "$DLEXT" = bundle ] || # separated to .dSYM directories
+        strip spec/ruby/optional/capi/ext/*.$DLEXT
+      env:
+        DLEXT: ${{ steps.config.outputs.DLEXT }}
+      working-directory: ${{ inputs.builddir }}
+      if: >-
+        ${{true
+        && ! steps.cache.outputs.cache-hit
+        && github.ref_name == 'master'
+        }}
+
+    - name: Save CAPI extensions
+      uses: actions/cache/save@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
+      with:
+        path: ${{ inputs.builddir }}/spec/ruby/optional/capi/ext/
+        key: ${{ steps.config.outputs.key }}
+      if: ${{ steps.strip.outcome == 'success' }}
+
+    - shell: bash
+      run: |
+        echo "::error::Change from ${prev} detected; bump up ABI version"
+      env:
+        prev: ${{ steps.config.outputs.version }}
+      if: ${{ always() && steps.check.outcome == 'failure' }}
diff --git a/.github/actions/compilers/action.yml b/.github/actions/compilers/action.yml
new file mode 100644
index 0000000000..c700bbfe9e
--- /dev/null
+++ b/.github/actions/compilers/action.yml
@@ -0,0 +1,164 @@
+name: Compiles ruby in a container
+description: >-
+  Makes ruby using a dedicated container
+
+inputs:
+  tag:
+    required: false
+    default: clang-20
+    description: >-
+      container image tag to use in this run.
+
+  with_gcc:
+    required: false
+    description: >-
+      override compiler path & flags.
+
+  CFLAGS:
+    required: false
+    description: >-
+      C compiler flags to override.
+
+  CXXFLAGS:
+    required: false
+    description: >-
+      C++ compiler flags to override.
+
+  optflags:
+    required: false
+    # -O1 is faster than -O3 in our tests... Majority of time are consumed trying
+    # to optimize binaries.  Also GitHub Actions run on relatively modern CPUs
+    # compared to, say, GCC 4 or Clang 3.  We don't specify `-march=native`
+    # because compilers tend not understand what the CPU is.
+    default: '-O1'
+    description: >-
+      Compiler flags for optimisations.
+
+  cppflags:
+    required: false
+    description: >-
+      Additional preprocessor flags.
+
+  append_configure:
+    required: false
+    default: >-
+      --without-valgrind
+      --without-jemalloc
+      --without-gmp
+    description: >-
+      flags to append to configure.
+
+  enable_shared:
+    required: false
+    default: true
+    description: >-
+      Whether to build libruby.so.
+
+  check:
+    required: false
+    default: ''
+    description: >-
+      Whether to run `make check`
+
+  test_all:
+    required: false
+    default: ''
+    description: >-
+      Whether to run `make test-all` with options for test-all.
+
+  test_spec:
+    required: false
+    default: ''
+    description: >-
+      Whether to run `make test-spec` with options for mspec.
+
+  static_exts:
+    required: false
+    description: >-
+      whitespace separated list of extensions that need be linked statically.
+
+runs:
+  using: composite
+  steps:
+    - shell: bash
+      run: docker pull --quiet "ghcr.io/ruby/ruby-ci-image:${INPUT_TAG}"
+      env:
+        INPUT_TAG: ${{ inputs.tag }}
+
+    - name: Enable Launchable conditionally
+      id: enable-launchable
+      run: echo "enable-launchable=true" >> $GITHUB_OUTPUT
+      shell: bash
+      if: >-
+        ${{
+        github.repository == 'ruby/ruby' ||
+        (github.repository != 'ruby/ruby' && env.LAUNCHABLE_TOKEN)
+        }}
+
+    - name: compile
+      shell: bash
+      run: >-
+        docker run
+        --rm
+        --user=root
+        --volume "${GITHUB_WORKSPACE}:/github/workspace:ro"
+        --workdir=/github/workspace
+        --entrypoint=/github/workspace/.github/actions/compilers/entrypoint.sh
+        --env CI
+        --env GITHUB_ACTION
+        --env INPUT_WITH_GCC
+        --env INPUT_CFLAGS
+        --env INPUT_CXXFLAGS
+        --env INPUT_OPTFLAGS
+        --env INPUT_CPPFLAGS
+        --env INPUT_APPEND_CONFIGURE
+        --env INPUT_CHECK
+        --env INPUT_TEST_ALL
+        --env INPUT_TEST_SPEC
+        --env INPUT_ENABLE_SHARED
+        --env INPUT_STATIC_EXTS
+        --env LAUNCHABLE_ORGANIZATION
+        --env LAUNCHABLE_WORKSPACE
+        --env LAUNCHABLE_ENABLED
+        --env GITHUB_PR_HEAD_SHA
+        --env GITHUB_PULL_REQUEST_URL
+        --env GITHUB_REF
+        --env GITHUB_ACTIONS
+        --env GITHUB_RUN_ID
+        --env GITHUB_REPOSITORY
+        --env GITHUB_WORKFLOW
+        --env GITHUB_RUN_NUMBER
+        --env GITHUB_EVENT_NAME
+        --env GITHUB_SHA
+        --env GITHUB_HEAD_REF
+        --env GITHUB_SERVER_URL
+        "ghcr.io/ruby/ruby-ci-image:${INPUT_TAG}"
+      env:
+        INPUT_TAG: ${{ inputs.tag }}
+        INPUT_WITH_GCC: ${{ inputs.with_gcc || inputs.tag }}
+        INPUT_CFLAGS: ${{ inputs.CFLAGS }}
+        INPUT_CXXFLAGS: ${{ inputs.CXXFLAGS }}
+        INPUT_OPTFLAGS: ${{ inputs.OPTFLAGS }}
+        INPUT_CPPFLAGS: ${{ inputs.cppflags }}
+        INPUT_APPEND_CONFIGURE: ${{ inputs.append_configure }}
+        INPUT_CHECK: ${{ inputs.check }}
+        INPUT_TEST_ALL: ${{ inputs.test_all }}
+        INPUT_TEST_SPEC: ${{ inputs.test_spec }}
+        INPUT_ENABLE_SHARED: ${{ inputs.enable_shared }}
+        INPUT_STATIC_EXTS: ${{ inputs.static_exts }}
+        LAUNCHABLE_ORGANIZATION: ${{ github.repository_owner }}
+        LAUNCHABLE_WORKSPACE: ${{ github.event.repository.name }}
+        LAUNCHABLE_ENABLED: ${{ steps.enable-launchable.outputs.enable-launchable || false }}
+        GITHUB_PR_HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+        GITHUB_PULL_REQUEST_URL: ${{ github.event.pull_request.html_url }}
+        GITHUB_REF: ${{ github.ref }}
+
+    # Clean up non-default docker images to save disk space.
+    # The default image (clang-20) is reused across multiple steps
+    # within the same job, so we keep it to avoid redundant pulls.
+    - name: clean up docker image
+      shell: bash
+      run: docker rmi "ghcr.io/ruby/ruby-ci-image:${INPUT_TAG}" || true
+      if: ${{ always() && inputs.tag != 'clang-20' }}
+      env:
+        INPUT_TAG: ${{ inputs.tag }}
diff --git a/.github/actions/compilers/entrypoint.sh b/.github/actions/compilers/entrypoint.sh
new file mode 100755
index 0000000000..b554151091
--- /dev/null
+++ b/.github/actions/compilers/entrypoint.sh
@@ -0,0 +1,90 @@
+#! /bin/bash
+
+# Copyright (c) 2024 Ruby developers.  All rights reserved.
+#
+# This file is  a part of the programming language  Ruby.  Permission is hereby
+# granted, to  either redistribute and/or  modify this file, provided  that the
+# conditions  mentioned in  the file  COPYING are  met.  Consult  the file  for
+# details.
+
+grouped()
+{
+    echo "::group::${@}"
+    "${@}"
+    echo "::endgroup::"
+}
+
+set -e
+set -u
+set -o pipefail
+
+srcdir="/github/workspace/src"
+builddir="$(mktemp -dt)"
+
+export GITHUB_WORKFLOW='Compilations'
+export CONFIGURE_TTY='never'
+export RUBY_DEBUG='ci rgengc'
+export RUBY_TESTOPTS='-q --color=always --tty=no'
+export RUBY_DEBUG_COUNTER_DISABLE='1'
+export GNUMAKEFLAGS="-j$((1 + $(nproc)))"
+
+case "x${INPUT_ENABLE_SHARED}" in
+x | xno | xfalse )
+    enable_shared='--disable-shared'
+    ;;
+*)
+    enable_shared='--enable-shared'
+    ;;
+esac
+
+pushd ${builddir}
+
+grouped git config --global --add safe.directory ${srcdir}
+
+grouped ${srcdir}/configure        \
+    -C                             \
+    --with-gcc="${INPUT_WITH_GCC}" \
+    --enable-debug-env             \
+    --disable-install-doc          \
+    --with-ext=-test-/cxxanyargs,+ \
+    --without-git                  \
+    ${enable_shared}               \
+    ${INPUT_APPEND_CONFIGURE}      \
+    CFLAGS="${INPUT_CFLAGS}"       \
+    CXXFLAGS="${INPUT_CXXFLAGS}"   \
+    optflags="${INPUT_OPTFLAGS}"   \
+    cppflags="${INPUT_CPPFLAGS}"   \
+    debugflags='-ggdb3' # -g0 disables backtraces when SEGV.  Do not set that.
+
+popd
+
+if [[ -n "${INPUT_STATIC_EXTS}" ]]; then
+    echo "::group::ext/Setup"
+    set -x
+    mkdir ${builddir}/ext
+    (
+        for ext in ${INPUT_STATIC_EXTS}; do
+            echo "${ext}"
+        done
+    ) >> ${builddir}/ext/Setup
+    set +x
+    echo "::endgroup::"
+fi
+
+if [ -n "$INPUT_TEST_ALL" ]; then
+  tests=" -- $INPUT_TEST_ALL"
+else
+  tests=" -- ruby -ext-"
+fi
+
+pushd ${builddir}
+
+grouped make showflags
+grouped make all
+# grouped make install
+
+# Run only `make test` by default. Run other tests if specified.
+grouped make test
+if [[ -n "$INPUT_CHECK" ]]; then grouped make test-tool; fi
+if [[ -n "$INPUT_CHECK" || -n "$INPUT_TEST_ALL" ]]; then grouped make test-all TESTS="$tests"; fi
+if [[ -n "$INPUT_CHECK" || -n "$INPUT_TEST_SPEC" ]]; then grouped env CHECK_LEAKS=true make test-spec MSPECOPT="$INPUT_TEST_SPEC"; fi
diff --git a/.github/actions/launchable/setup/action.yml b/.github/actions/launchable/setup/action.yml
new file mode 100644
index 0000000000..305878492c
--- /dev/null
+++ b/.github/actions/launchable/setup/action.yml
@@ -0,0 +1,337 @@
+name: Set up Launchable
+description: >-
+  Install the required dependencies and execute the necessary Launchable commands for test recording
+
+inputs:
+  os:
+    required: true
+    description: The operating system that CI runs on. This value is used in Launchable flavor.
+
+  test-opts:
+    default: none
+    required: false
+    description: >-
+      Test options that determine how tests are run.
+      This value is used in the Launchable flavor.
+
+  launchable-token:
+    required: false
+    description: >-
+      Launchable token is needed if you want to run Launchable on your forked repository.
+      See https://github.com/ruby/ruby/wiki/CI-Servers#launchable-ci for details.
+
+  builddir:
+    required: false
+    default: ${{ github.workspace }}
+    description: >-
+      Directory to create Launchable report file.
+
+  srcdir:
+    required: false
+    default: ${{ github.workspace }}
+    description: >-
+      Directory to (re-)checkout source codes. Launchable retrieves the commit information
+      from the directory.
+
+  test-task:
+    required: false
+    default: ${{ matrix.test_task }}
+    description: >-
+      Specifies a single test task to be executed.
+      This value is used in the Launchable flavor.
+      Either 'test-task' or 'multi-test-tasks' must be configured.
+
+  test-tasks:
+    required: false
+    default: '[]'
+    description: >-
+      Specifies an array of multiple test tasks to be executed.
+      For example: '["test", "test-all"]'.
+      If you want to run a single test task, use the 'test-task' input instead.
+
+  is-yjit:
+    required: false
+    default: 'false'
+    description: >-
+      Whether this workflow is executed on YJIT.
+
+  is-zjit:
+    required: false
+    default: 'false'
+    description: >-
+      Whether this workflow is executed on ZJIT.
+
+outputs:
+  stdout_report_path:
+    value: ${{ steps.global.outputs.stdout_report_path }}
+    description: >-
+      Report file path for standard output.
+
+  stderr_report_path:
+    value: ${{ steps.global.outputs.stderr_report_path }}
+    description: >-
+      Report file path for standard error.
+
+runs:
+  using: composite
+
+  steps:
+    - name: Enable Launchable conditionally
+      id: enable-launchable
+      run: echo "enable-launchable=true" >> $GITHUB_OUTPUT
+      shell: bash
+      if: >-
+        ${{
+        (github.repository == 'ruby/ruby'
+          || (github.repository != 'ruby/ruby'
+          && env.LAUNCHABLE_TOKEN))
+        && (inputs.test-task == 'check'
+          || inputs.test-task == 'test-all'
+          || inputs.test-task == 'test'
+          || contains(fromJSON(inputs.test-tasks), 'test-all')
+          || contains(fromJSON(inputs.test-tasks), 'test'))
+        }}
+
+    # Launchable CLI requires Python and Java.
+    # https://www.launchableinc.com/docs/resources/cli-reference/
+    - name: Set up Python
+      uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+      with:
+        python-version: "3.x"
+      if: >-
+        ${{ steps.enable-launchable.outputs.enable-launchable
+        && !endsWith(inputs.os, 'ppc64le') && !endsWith(inputs.os, 's390x') }}
+
+    - name: Set up Java
+      uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4.8.0
+      with:
+        distribution: 'temurin'
+        java-version: '17'
+      if: >-
+        ${{ steps.enable-launchable.outputs.enable-launchable
+        && !endsWith(inputs.os, 'ppc64le') && !endsWith(inputs.os, 's390x') }}
+
+    - name: Set up Java ppc64le
+      uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4.8.0
+      with:
+        distribution: 'semeru'
+        architecture: 'ppc64le'
+        java-version: '17'
+      if: >-
+        ${{ steps.enable-launchable.outputs.enable-launchable
+        && endsWith(inputs.os, 'ppc64le') }}
+
+    - name: Set up Java s390x
+      uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4.8.0
+      with:
+        distribution: 'semeru'
+        architecture: 's390x'
+        java-version: '17'
+      if: >-
+        ${{ steps.enable-launchable.outputs.enable-launchable
+        && endsWith(inputs.os, 's390x') }}
+
+    - name: Set global vars
+      id: global
+      shell: bash
+      run: |
+        test_all_enabled="${{ inputs.test-task == 'check' ||  inputs.test-task == 'test-all' || contains(fromJSON(inputs.test-tasks), 'test-all') }}"
+        btest_enabled="${{ inputs.test-task == 'check' ||  inputs.test-task == 'test' || contains(fromJSON(inputs.test-tasks), 'test') }}"
+        test_spec_enabled="${{ inputs.test-task == 'check' ||  inputs.test-task == 'test-spec' || contains(fromJSON(inputs.test-tasks), 'test-spec') }}"
+        echo test_all_enabled="${test_all_enabled}" >> $GITHUB_OUTPUT
+        echo btest_enabled="${btest_enabled}" >> $GITHUB_OUTPUT
+        echo test_spec_enabled="${test_spec_enabled}" >> $GITHUB_OUTPUT
+        echo test_all_report_file='launchable_test_all_report.json' >> $GITHUB_OUTPUT
+        echo btest_report_file='launchable_btest_report.json' >> $GITHUB_OUTPUT
+        echo test_spec_report_dir='launchable_test_spec_report' >> $GITHUB_OUTPUT
+        echo stdout_report_path="launchable_stdout.log" >> $GITHUB_OUTPUT
+        echo stderr_report_path="launchable_stderr.log" >> $GITHUB_OUTPUT
+      if: steps.enable-launchable.outputs.enable-launchable
+
+    - name: Set environment variables for Launchable
+      shell: bash
+      run: | # zizmor: ignore[github-env]
+        : # GITHUB_PULL_REQUEST_URL are used for commenting test reports in Launchable Github App.
+        : # https://github.com/launchableinc/cli/blob/v1.80.1/launchable/utils/link.py#L42
+        echo "GITHUB_PULL_REQUEST_URL=${INPUT_PR_HTML_URL}" >> $GITHUB_ENV
+        : # The following envs are necessary in Launchable tokenless authentication.
+        : # https://github.com/launchableinc/cli/blob/v1.80.1/launchable/utils/authentication.py#L20
+        echo "LAUNCHABLE_ORGANIZATION=${INPUT_REPOSITORY_OWNER}" >> $GITHUB_ENV
+        echo "LAUNCHABLE_WORKSPACE=${INPUT_REPOSITORY_NAME}" >> $GITHUB_ENV
+        : # https://github.com/launchableinc/cli/blob/v1.80.1/launchable/utils/authentication.py#L71
+        echo "GITHUB_PR_HEAD_SHA=${INPUT_PR_HEAD_SHA}" >> $GITHUB_ENV
+        echo "LAUNCHABLE_TOKEN=${INPUT_LAUNCHABLE_TOKEN}" >> $GITHUB_ENV
+        : # To prevent a slowdown in CI, disable request retries when the Launchable server is unstable.
+        echo "LAUNCHABLE_SKIP_TIMEOUT_RETRY=1" >> $GITHUB_ENV
+        echo "LAUNCHABLE_COMMIT_TIMEOUT=1" >> $GITHUB_ENV
+      env:
+        INPUT_PR_HTML_URL: ${{ github.event.pull_request.html_url }}
+        INPUT_REPOSITORY_OWNER: ${{ github.repository_owner }}
+        INPUT_REPOSITORY_NAME: ${{ github.event.repository.name }}
+        INPUT_PR_HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+        INPUT_LAUNCHABLE_TOKEN: ${{ inputs.launchable-token }}
+      if: steps.enable-launchable.outputs.enable-launchable
+
+    - name: Set up path
+      shell: bash
+      working-directory: ${{ inputs.srcdir }}
+      # Since updated PATH variable will be available in only subsequent actions, we need to add the path beforehand.
+      # https://docs.github.com/en/actions/using-workflows/workflow-commands-for-github-actions#adding-a-system-path
+      run: echo "$(python -msite --user-base)/bin" >> $GITHUB_PATH # zizmor: ignore[github-env]
+      if: >-
+        ${{
+        steps.enable-launchable.outputs.enable-launchable
+        && (startsWith(inputs.os, 'macos')
+          || endsWith(inputs.os, 'ppc64le')
+          || endsWith(inputs.os, 's390x'))
+        }}
+
+    - name: Set up Launchable
+      id: setup-launchable
+      shell: bash
+      working-directory: ${{ inputs.srcdir }}
+      run: | # zizmor: ignore[github-env]
+        set -x
+        pip install --user launchable
+        : # The build name cannot include a slash, so we replace the string here.
+        github_ref="${INPUT_GITHUB_REF}"
+        github_ref="${github_ref//\//_}"
+        : # With the --name option, we need to configure a unique identifier for this build.
+        : # To avoid setting the same build name as the CI which runs on other branches, we use the branch name here.
+        build_name="${github_ref}_${GITHUB_PR_HEAD_SHA}"
+        test_opts="${INPUT_TEST_OPTS}"
+        test_opts="${test_opts// /}"
+        test_opts="${test_opts//=/:}"
+        test_all_test_suite='test-all'
+        btest_test_suite='btest'
+        test_spec_test_suite='test-spec'
+        if [ "${INPUT_IS_YJIT}" = "true" ]; then
+          test_all_test_suite="yjit-${test_all_test_suite}"
+          btest_test_suite="yjit-${btest_test_suite}"
+          test_spec_test_suite="yjit-${test_spec_test_suite}"
+        fi
+        if [ "${INPUT_IS_ZJIT}" = "true" ]; then
+          test_all_test_suite="zjit-${test_all_test_suite}"
+          btest_test_suite="zjit-${btest_test_suite}"
+          test_spec_test_suite="zjit-${test_spec_test_suite}"
+        fi
+        # launchable_setup target var -- refers ${target} prefixed variables
+        launchable_setup() {
+          local target=$1 session
+          eval [ "\${${target}_enabled}" = "true" ] || return
+          eval local suite=\${${target}_test_suite}
+          session=$(launchable record session \
+            --build "${build_name}" \
+            --observation \
+            --flavor os="${INPUT_OS}" \
+            --flavor test_task="${INPUT_TEST_TASK}" \
+            --flavor test_opts="${test_opts}" \
+            --flavor workflow="${INPUT_WORKFLOW}" \
+            --test-suite ${suite} \
+            )
+          echo "${target}_session=${session}" >> $GITHUB_OUTPUT
+        }
+
+        launchable record build --name "${build_name}"
+        if launchable_setup test_all; then
+          echo "TESTS=${TESTS:+$TESTS }--launchable-test-reports=${test_all_report_file}" >> $GITHUB_ENV
+        fi
+        if launchable_setup btest; then
+          echo "BTESTS=${BTESTS:+$BTESTS }--launchable-test-reports=${btest_report_file}" >> $GITHUB_ENV
+        fi
+        if launchable_setup test_spec; then
+          echo "SPECOPTS=${SPECOPTS:$SPECOPTS }--launchable-test-reports=${test_spec_report_dir}" >> $GITHUB_ENV
+          echo test_spec_enabled=true >> $GITHUB_OUTPUT
+        fi
+
+        echo launchable_setup_dir=$(pwd) >> $GITHUB_OUTPUT
+      if: steps.enable-launchable.outputs.enable-launchable
+      env:
+        INPUT_GITHUB_REF: ${{ github.ref }}
+        INPUT_TEST_OPTS: ${{ inputs.test-opts }}
+        INPUT_IS_YJIT: ${{ inputs.is-yjit }}
+        INPUT_IS_ZJIT: ${{ inputs.is-zjit }}
+        INPUT_OS: ${{ inputs.os }}
+        INPUT_TEST_TASK: ${{ inputs.test-task }}
+        INPUT_WORKFLOW: ${{ github.workflow }}
+        test_all_enabled: ${{ steps.global.outputs.test_all_enabled }}
+        btest_enabled: ${{ steps.global.outputs.btest_enabled }}
+        test_spec_enabled: ${{ steps.global.outputs.test_spec_enabled }}
+        test_all_report_file: ${{ steps.global.outputs.test_all_report_file }}
+        btest_report_file: ${{ steps.global.outputs.btest_report_file }}
+        test_spec_report_dir: ${{ steps.global.outputs.test_spec_report_dir }}
+
+    - name: make test-spec report directory in build directory
+      shell: bash
+      working-directory: ${{ inputs.builddir }}
+      run: mkdir "${test_spec_report_dir}"
+      if: ${{ steps.setup-launchable.outputs.test_spec_enabled == 'true' }}
+      env:
+        test_spec_report_dir: ${{ steps.global.outputs.test_spec_report_dir }}
+
+    - name: Clean up test results in Launchable
+      uses: gacts/run-and-post-run@81b6ce503cde93862cec047c54652e45c5dca991 # v1.4.3
+      with:
+        shell: bash
+        working-directory: ${{ inputs.builddir }}
+        post: |
+          rm -f "${test_all_report_file}"
+          rm -f "${btest_report_file}"
+          rm -fr "${test_spec_report_dir}"
+          rm -f launchable_stdout.log
+          rm -f launchable_stderr.log
+      if: always() && steps.setup-launchable.outcome == 'success'
+      env:
+        test_all_report_file: ${{ steps.global.outputs.test_all_report_file }}
+        btest_report_file: ${{ steps.global.outputs.btest_report_file }}
+        test_spec_report_dir: ${{ steps.global.outputs.test_spec_report_dir }}
+
+    - name: Record test results in Launchable
+      uses: gacts/run-and-post-run@81b6ce503cde93862cec047c54652e45c5dca991 # v1.4.3
+      with:
+        shell: bash
+        working-directory: ${{ inputs.builddir }}
+        post: |
+          if [[ "${test_all_enabled}" = "true" ]]; then \
+            launchable record attachment \
+              --session "${test_all_session}" \
+              "${stdout_report_path}" \
+              "${stderr_report_path}"; \
+            launchable record tests \
+              --session "${test_all_session}" \
+              raw "${test_all_report_file}" || true; \
+          fi
+
+          if [[ "${btest_enabled}" = "true" ]]; then \
+            launchable record attachment \
+              --session "${btest_session}" \
+              "${stdout_report_path}" \
+              "${stderr_report_path}"; \
+            launchable record tests \
+              --session "${btest_session}" \
+              raw "${btest_report_file}" || true; \
+          fi
+
+          if [[ "${test_spec_enabled}" = "true" ]]; then \
+            launchable record attachment \
+              --session "${test_spec_session}" \
+              "${stdout_report_path}" \
+              "${stderr_report_path}"; \
+            launchable record tests \
+              --session "${test_spec_session}" \
+              raw ${test_spec_report_dir}/* || true; \
+          fi
+      if: ${{ always() && steps.setup-launchable.outcome == 'success' }}
+      env:
+        test_all_report_file: ${{ steps.global.outputs.test_all_report_file }}
+        btest_report_file: ${{ steps.global.outputs.btest_report_file }}
+        test_spec_report_dir: ${{ steps.global.outputs.test_spec_report_dir }}
+        test_all_enabled: ${{ steps.global.outputs.test_all_enabled }}
+        btest_enabled: ${{ steps.global.outputs.btest_enabled }}
+        test_spec_enabled: ${{ steps.global.outputs.test_spec_enabled }}
+        test_all_session: ${{ steps.setup-launchable.outputs.test_all_session }}
+        btest_session: ${{ steps.setup-launchable.outputs.btest_session }}
+        test_spec_session: ${{ steps.setup-launchable.outputs.test_spec_session }}
+        stdout_report_path: ${{ steps.global.outputs.stdout_report_path }}
+        stderr_report_path: ${{ steps.global.outputs.stderr_report_path }}
+        LAUNCHABLE_SETUP_DIR: ${{ steps.setup-launchable.outputs.launchable_setup_dir }}
diff --git a/.github/actions/make-snapshot/action.yml b/.github/actions/make-snapshot/action.yml
new file mode 100644
index 0000000000..4552f0e067
--- /dev/null
+++ b/.github/actions/make-snapshot/action.yml
@@ -0,0 +1,77 @@
+name: 'make-snapshot'
+description: 'Make snapshot tarballs'
+inputs:
+  archname:
+    description: 'archname passed to tool/make-snapshot (e.g. snapshot-master)'
+    required: true
+  version:
+    description: 'Target Version'
+    required: false
+  shallow-since:
+    description: 'git fetch --shallow-since'
+    required: true
+    default: '2018-12-25 00:00:00'
+  fetch-branch:
+    description: 'fetch branch'
+    required: false
+  srcdir:
+    description: 'srcdir for tool/make-snapshot. Empty = clone ruby/ruby into ./ruby.'
+    required: false
+    default: ''
+  upload-artifact:
+    description: 'Upload Packages and Info as workflow artifacts. Pass "false" when callers run in a matrix that would collide on artifact names.'
+    required: false
+    default: 'true'
+
+runs:
+  using: "composite"
+  steps:
+    - name: Install libraries
+      run: |
+        set -x
+        sudo apt-get update -q || :
+        sudo apt-get install --no-install-recommends -q -y build-essential git bison autoconf ruby p7zip-full curl
+      shell: bash
+    - name: Checkout ruby/ruby for tool/make-snapshot
+      if: inputs.srcdir == ''
+      run: git clone --single-branch --depth=1 https://github.com/ruby/ruby ruby
+      shell: bash
+    - name: Fetch branches and notes (clone mode)
+      if: inputs.srcdir == ''
+      env:
+        SHALLOW_SINCE: ${{ inputs.shallow-since }}
+        FETCH_BRANCH: ${{ inputs.fetch-branch }}
+      run: |
+        set -x
+        cd ruby
+        git fetch --shallow-since="$SHALLOW_SINCE"
+        [ -n "$FETCH_BRANCH" ] && git fetch origin "+$FETCH_BRANCH:$FETCH_BRANCH"
+        git fetch origin '+refs/notes/commits:refs/notes/commits'
+        git fetch origin '+refs/notes/log-fix:refs/notes/log-fix'
+      shell: bash
+    - name: Fetch notes (local srcdir mode)
+      if: inputs.srcdir != ''
+      working-directory: ${{ inputs.srcdir }}
+      run: |
+        git fetch origin '+refs/notes/commits:refs/notes/commits' || :
+        git fetch origin '+refs/notes/log-fix:refs/notes/log-fix' || :
+      shell: bash
+    - name: Make snapshot
+      env:
+        ARCHNAME: ${{ inputs.archname }}
+        SRCDIR: ${{ inputs.srcdir }}
+        VERSION: ${{ inputs.version }}
+      run: |
+        [ -z "$SRCDIR" ] && SRCDIR=ruby
+        ruby "$SRCDIR/tool/make-snapshot" "-archname=$ARCHNAME" -srcdir="$SRCDIR" -packages=gzip,xz,zip pkg $VERSION
+      shell: bash
+    - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      with:
+        name: Packages
+        path: pkg
+      if: ${{ inputs.upload-artifact == 'true' }}
+    - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      with:
+        name: Info
+        path: pkg/info
+      if: ${{ inputs.upload-artifact == 'true' }}
diff --git a/.github/actions/setup/baseruby/action.yml b/.github/actions/setup/baseruby/action.yml
new file mode 100644
index 0000000000..76fe068897
--- /dev/null
+++ b/.github/actions/setup/baseruby/action.yml
@@ -0,0 +1,73 @@
+name: Setup directories etc.
+description: >-
+  Build baseruby for cross-compiling
+
+inputs:
+  srcdir:
+    required: true
+    default: ${{ github.workspace }}
+    description: >-
+      Directory of source codes.
+
+  builddir:
+    required: false
+    default: ${{ github.workspace }}/baseruby
+    description: >-
+      Where baseruby will be built.
+
+  installdir:
+    required: false
+    default: install
+    description: >-
+      The path where the baseruby will be installed to.
+      This is relative from the workspace.
+
+outputs:
+  ruby:
+    value: ${{ steps.build.outputs.installdir }}/bin/ruby
+    description: >-
+      The path of the executable baseruby.
+  dump_ast:
+    value: ${{ steps.build.outputs.installdir }}/bin/dump_ast
+    description: >-
+      The path of the executable dump_ast.
+
+runs:
+  using: composite
+
+  steps:
+    - name: Build baseruby
+      shell: bash
+      id: build
+      run: |
+        case "$installdir" in /*) ;; *) installdir="$PWD/$installdir";; esac
+        mkdir "$builddir"
+        ln -sr "$srcdir" "$builddir/.src"
+        pushd "$builddir"
+        .src/configure "--prefix=${installdir}" --disable-install-doc
+        CONFIGURE_ARGS=--with-out-ext=-test- make install
+        install dump_ast "${installdir}/bin"
+        {
+          echo "${installdir}/bin/dump_ast"
+          echo "${installdir}/.installed.list"
+          echo "${installdir}/"
+        } >> .installed.list
+        cp .installed.list "${installdir}/"
+        make distclean
+        rm .src
+        popd
+        rmdir "$builddir"
+        {
+          echo "installdir=${installdir}"
+        } | tee -a "$GITHUB_OUTPUT"
+      env:
+        srcdir: ${{ inputs.srcdir }}
+        builddir: ${{ inputs.builddir }}
+        installdir: ${{ inputs.installdir }}
+
+    - name: clean
+      uses: gacts/run-and-post-run@598d7a875d5620e0457490555b5e18e46082aa47 # v1.4.4
+      with:
+        working-directory: ${{ inputs.srcdir }}
+        post: |
+          ruby tool/rbuninstall.rb "${{ steps.build.outputs.installdir }}/.installed.list" > /dev/null
diff --git a/.github/actions/setup/directories/action.yml b/.github/actions/setup/directories/action.yml
new file mode 100644
index 0000000000..589049a4b8
--- /dev/null
+++ b/.github/actions/setup/directories/action.yml
@@ -0,0 +1,205 @@
+name: Setup directories etc.
+description: >-
+  Set up the source code and build directories (plus some
+  environmental tweaks)
+
+inputs:
+  srcdir:
+    required: false
+    default: ${{ github.workspace }}
+    description: >-
+      Directory to (re-)checkout source codes.  This will be created
+      if absent.  If there is no `configure` file that is also
+      generated inside.
+
+  builddir:
+    required: false
+    default: ${{ github.workspace }}
+    description: >-
+      Where binaries and other generated contents go.  This will be
+      created if absent.
+
+  make-command:
+    required: false
+    type: string
+    default: 'make'
+    description: >-
+      The command of `make`.
+
+  makeup:
+    required: false
+    type: boolean
+    # Note that `default: false` evaluates to a string constant
+    # `'false'`, which is a truthy value :sigh:
+    # https://github.com/actions/runner/issues/2238
+    default: ''
+    description: >-
+      If set to true, additionally runs `make up`.
+
+  checkout:
+    required: false
+    type: boolean
+    default: true
+    description: >-
+      If set to '' (false), skip running actions/checkout. This is useful when
+      you don't want to overwrite a GitHub token that is already set up.
+
+  dummy-files:
+    required: false
+    type: boolean
+    default: ''
+    description: >-
+      If set to true, creates dummy files in build dir.
+
+  fetch-depth:
+    required: false
+    default: '1'
+    description: The depth of commit history fetched from the remote repository
+
+  clean:
+    required: false
+    type: boolean
+    default: ''
+    description: >-
+      If set to true, clean build directory.
+
+outputs: {} # nothing?
+
+runs:
+  using: composite
+
+  steps:
+    # Note that `shell: bash` works on both Windows and Linux, but not
+    # `shell: sh`.  This is because GitHub hosted Windows runners have
+    # their bash manually installed.
+    - shell: bash
+      run: |
+        mkdir -p "${INPUT_SRCDIR}"
+        mkdir -p "${INPUT_BUILDDIR}"
+      env:
+        INPUT_SRCDIR: ${{ inputs.srcdir }}
+        INPUT_BUILDDIR: ${{ inputs.builddir }}
+
+    # Did you know that actions/checkout works without git(1)?  We are
+    # checking that here.
+    - id: which
+      shell: bash
+      run: |
+        echo "git=`command -v git`" >> "$GITHUB_OUTPUT"
+        echo "sudo=`sudo true && command -v sudo`" >> "$GITHUB_OUTPUT"
+        echo "autoreconf=`command -v autoreconf`" >> "$GITHUB_OUTPUT"
+
+    - if: steps.which.outputs.git
+      shell: bash
+      run: |
+        git config --global core.autocrlf false
+        git config --global core.eol lf
+        git config --global advice.detachedHead 0
+        git config --global init.defaultBranch garbage
+
+    - if: inputs.checkout
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      with:
+        path: ${{ inputs.srcdir }}
+        fetch-depth: ${{ inputs.fetch-depth }}
+        persist-credentials: false
+
+    - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+      with:
+        path: ${{ inputs.srcdir }}/.downloaded-cache
+        key: ${{ runner.os }}-${{ runner.arch }}-downloaded-cache
+
+    - if: steps.which.outputs.autoreconf
+      shell: bash
+      working-directory: ${{ inputs.srcdir }}
+      run: ./autogen.sh --install
+
+    # This is for MinGW.
+    - if: runner.os == 'Windows'
+      shell: bash
+      run: echo "GNUMAKEFLAGS=-j$((2 * NUMBER_OF_PROCESSORS))" >> $GITHUB_ENV # zizmor: ignore[github-env]
+
+    - if: runner.os == 'Linux'
+      shell: bash
+      run: echo "GNUMAKEFLAGS=-sj$((1 + $(nproc)))" >> "$GITHUB_ENV" # zizmor: ignore[github-env]
+
+    # macOS' GNU make is so old that they doesn't understand `GNUMAKEFLAGS`.
+    - if: runner.os == 'macOS'
+      shell: bash
+      run: echo "MAKEFLAGS=-j$((1 + $(sysctl -n hw.activecpu)))" >> "$GITHUB_ENV" # zizmor: ignore[github-env]
+
+    - if: inputs.makeup
+      shell: bash
+      working-directory: ${{ inputs.srcdir }}
+      run: |
+        touch config.status .rbconfig.time
+        for mk in Makefile GNUmakefile; do
+          sed -f tool/prereq.status template/$mk.in > $mk
+        done
+        make up
+
+    # Cleanup, runs even on failure
+    - if: always() && inputs.makeup
+      shell: bash
+      working-directory: ${{ inputs.srcdir }}
+      run: |
+        rm -f config.status .rbconfig.time \
+          Makefile GNUmakefile uncommon.mk enc.mk noarch-fake.rb
+        rm -f prism/.time prism/util/.time
+
+    - if: steps.which.outputs.sudo
+      shell: bash
+      run: |
+        sudo chmod -R go-w /usr/share
+        chmod -v go-w $HOME $HOME/.config || :
+        declare -a dirs # -A is not supported by old bash, e.g. macos
+        SAVE_IFS="$IFS" IFS=:; set $PATH
+        for d do
+          while [ -d "$d" ]; do
+            case "$IFS${dirs[*]}$IFS" in *"$IFS$d$IFS"*) ;; *) dirs+=("$d");; esac
+            d="${d%/*}"
+          done
+        done
+        IFS="$SAVE_IFS"
+        sudo chmod -v go-w "${dirs[@]}" || :
+
+    - if: inputs.dummy-files == 'true'
+      shell: bash
+      id: dummy-files
+      working-directory: ${{ inputs.builddir }}
+      run: |
+        : Create dummy files in build dir
+        set {{a..z},{A..Z},{0..9},foo,bar,test,zzz}.rb
+        for file; do \
+          echo > $file "raise 'do not load $file'"; \
+        done
+        # drop {a..z}.rb if case-insensitive filesystem
+        grep -F A.rb a.rb > /dev/null && set "${@:27}"
+        echo clean="cd ${INPUT_BUILDDIR} && rm $*" >> $GITHUB_OUTPUT
+      env:
+        INPUT_BUILDDIR: ${{ inputs.builddir }}
+
+    - if: inputs.clean == 'true'
+      shell: bash
+      id: clean
+      run: |
+        echo distclean="cd ${INPUT_BUILDDIR} && ${INPUT_MAKE_COMMAND} distclean" >> $GITHUB_OUTPUT
+        echo remained-files="find ${INPUT_BUILDDIR} -ls" >> $GITHUB_OUTPUT
+        [ "${INPUT_BUILDDIR}" = "${INPUT_SRCDIR}" ] ||
+        echo final="rmdir ${INPUT_BUILDDIR}" >> $GITHUB_OUTPUT
+      env:
+        INPUT_BUILDDIR: ${{ inputs.builddir }}
+        INPUT_SRCDIR: ${{ inputs.srcdir }}
+        INPUT_MAKE_COMMAND: ${{ inputs.make-command }}
+
+    - name: clean
+      uses: gacts/run-and-post-run@598d7a875d5620e0457490555b5e18e46082aa47 # v1.4.4
+      with:
+        working-directory:
+        post: |
+          ${{ steps.dummy-files.outputs.clean }}
+          ${{ steps.clean.outputs.distclean }}
+          ${{ steps.clean.outputs.remained-files }}
+          ${{ steps.clean.outputs.final }}
+      # rmdir randomly fails due to launchable files
+      continue-on-error: true
diff --git a/.github/actions/setup/macos/action.yml b/.github/actions/setup/macos/action.yml
new file mode 100644
index 0000000000..9cd37a9b12
--- /dev/null
+++ b/.github/actions/setup/macos/action.yml
@@ -0,0 +1,29 @@
+name: Setup macOS environment
+description: >-
+  Installs necessary packages via Homebrew.
+
+inputs: {} # nothing?
+
+outputs: {} # nothing?
+
+runs:
+  using: composite
+
+  steps:
+    - name: brew
+      shell: bash
+      run: |
+        brew install --quiet jemalloc gmp libffi openssl@3 zlib autoconf automake libtool
+
+    - name: Set ENV
+      shell: bash
+      run: | # zizmor: ignore[github-env]
+        dir_config() {
+          local args=() lib var="$1"; shift
+          for lib in "$@"; do
+            args+=("--with-${lib%@*}-dir=$(brew --prefix $lib)")
+          done
+          echo "$var=${args[*]}" >> $GITHUB_ENV
+        }
+        dir_config ruby_configure_args gmp
+        dir_config CONFIGURE_ARGS openssl@3
diff --git a/.github/actions/setup/ubuntu/action.yml b/.github/actions/setup/ubuntu/action.yml
new file mode 100644
index 0000000000..5209ccc03f
--- /dev/null
+++ b/.github/actions/setup/ubuntu/action.yml
@@ -0,0 +1,72 @@
+name: Setup ubuntu environment
+description: >-
+  At the beginning there was no way but to copy & paste `apt-get`
+  everywhere.  But now that we have composite actions, it seems better
+  merge them into one.
+
+inputs:
+  arch:
+    required: false
+    default: ''
+    description: >-
+      Architecture.  Because we run this on a GitHub-hosted runner
+      acceptable value for this input is very limited.
+
+outputs:
+  arch:
+    value: ${{ steps.uname.outputs.uname }}
+    description: >-
+      Actual architecture.  This could be different from the one
+      passed to the `inputs.arch`.  For instance giving `i386` to this
+      action yields `i686`.
+
+runs:
+  using: composite
+
+  steps:
+    - id: uname
+      name: uname
+      shell: bash
+      env:
+        arch: ${{ inputs.arch }}
+      run: |
+        setarch="${arch:+setarch $arch --}"
+        # normalize `uname`
+        if uname=$(${setarch} uname -m 2> /dev/null); then
+          # `setarch` works, `$arch` is a valid architecture name.
+          echo "setarch=${setarch}" >> "$GITHUB_OUTPUT"
+        else
+          # if `setarch` failed, take the given `arch` as-is.
+          uname="${arch}"
+          setarch=""
+        fi
+        echo "uname=$uname" >> "$GITHUB_OUTPUT"
+        echo "dpkg=${uname/686/386}" >> "$GITHUB_OUTPUT"
+
+    - name: set SETARCH
+      shell: bash
+      run: echo "SETARCH=${setarch}" >> "$GITHUB_ENV" # zizmor: ignore[github-env]
+      env:
+        setarch: ${{ steps.uname.outputs.setarch }} # validated
+
+    - name: dpkg setup
+      shell: bash
+      run: sudo dpkg --add-architecture "${dpkg}"
+      # `dpkg` is valid, also `uname`.
+      if: ${{ inputs.arch }}
+      env:
+        dpkg: ${{ steps.uname.outputs.dpkg }}
+
+    - name: apt-get
+      shell: bash
+      env:
+        arch: ${{ inputs.arch && format(':{0}', steps.uname.outputs.dpkg) || '' }}
+      run: |
+        set -x
+        sudo apt-get update -qq || :
+        sudo apt-get install --no-install-recommends -qq -y -o=Dpkg::Use-Pty=0 \
+        ${arch:+cross}build-essential${arch/:/-} \
+        libssl-dev${arch} libyaml-dev${arch} libreadline6-dev${arch} \
+        zlib1g-dev${arch} libncurses5-dev${arch} libffi-dev${arch} \
+        autoconf ruby
+        sudo apt-get install -qq -y pkg-config${arch} || :
diff --git a/.github/actions/slack/action.yml b/.github/actions/slack/action.yml
new file mode 100644
index 0000000000..6f89bef11a
--- /dev/null
+++ b/.github/actions/slack/action.yml
@@ -0,0 +1,51 @@
+name: Post a message to slack
+description: >-
+  We have our ruby/action-slack webhook.  However its arguments are
+  bit verbose to be listed in every workflow files.  Better merge them
+  into one.
+
+inputs:
+  SLACK_WEBHOOK_URL:
+    required: true
+    description: >-
+      The URL to post the payload.  This is an input because it tends
+      to be stored in a secrets vault and a composite action cannot
+      look into one.
+
+  label:
+    required: false
+    description: >-
+      Human-readable description of the run, something like "DEBUG=1".
+      This need not be unique among runs.
+
+  event_name:
+    required: false
+    default: 'push'
+    description: >-
+      Target event to trigger notification. Notify only push by default.
+
+  extra_channel_id:
+    required: false
+    description: >-
+      Slack channel ID to notify besides #alerts and #alerts-emoji.
+
+outputs: {} # Nothing?
+
+runs:
+  using: composite
+
+  steps:
+    - uses: ruby/action-slack@d260b61aa817726d5bedd22dd6cc305787fa4cdd # v4.0.0
+      with:
+        payload: |
+          {
+            "ci": "GitHub Actions",
+            "env": "${{ github.workflow }}${{ inputs.label && format(' / {0}', inputs.label) }}",
+            "url": "https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}",
+            "commit": "${{ github.sha }}",
+            "branch": "${{ github.ref_name }}"
+            ${{ inputs.extra_channel_id && format(', "extra_channel_id": "{0}"', inputs.extra_channel_id) }}
+          }
+      env:
+        SLACK_WEBHOOK_URL: ${{ inputs.SLACK_WEBHOOK_URL }}
+      if: ${{ github.event_name == inputs.event_name && startsWith(github.repository, 'ruby/') }}
diff --git a/.github/auto_request_review.yml b/.github/auto_request_review.yml
new file mode 100644
index 0000000000..9e20cb7459
--- /dev/null
+++ b/.github/auto_request_review.yml
@@ -0,0 +1,21 @@
+files:
+  'yjit*': [team:jit]
+  'yjit/**/*': [team:jit]
+  'yjit/src/cruby_bindings.inc.rs': []
+  'bootstraptest/test_yjit*': [team:jit]
+  'test/ruby/test_yjit*': [team:jit]
+  'zjit*': [team:jit]
+  'zjit/**/*': [team:jit]
+  'zjit/src/cruby_bindings.inc.rs': []
+  'test/ruby/test_zjit*': [team:jit]
+  'defs/jit.mk': [team:jit]
+  'tool/zjit_bisect.rb': [team:jit]
+  'doc/jit/*': [team:jit]
+  # Skip files updated by dependabot. It's noisy in notifications, and they're auto-merged anyway.
+  'yjit/Cargo.lock': []
+  'zjit/Cargo.lock': []
+  '.github/workflows/yjit-*.yml': []
+  '.github/workflows/zjit-*.yml': []
+options:
+  ignore_draft: true
+  last_files_match_only: true
diff --git a/.github/codeql/codeql-config.yml b/.github/codeql/codeql-config.yml
new file mode 100644
index 0000000000..f5d33545c1
--- /dev/null
+++ b/.github/codeql/codeql-config.yml
@@ -0,0 +1,22 @@
+paths-ignore:
+  - benchmark
+  - sample
+  - spec/ruby/command_line/fixtures
+  - spec/ruby/core/enumerable/shared/inject.rb
+  - spec/ruby/core/exception/fixtures
+  - spec/ruby/core/proc/parameters_spec.rb
+  - spec/ruby/core/proc/ruby2_keywords_spec.rb
+  - spec/ruby/core/range/reverse_each_spec.rb
+  - spec/ruby/language/fixtures
+  - spec/ruby/language/lambda_spec.rb
+  - spec/ruby/language/method_spec.rb
+  - spec/ruby/language/string_spec.rb
+  - test/error_highlight/test_error_highlight.rb
+  - test/prism/result/named_capture_test.rb
+  - test/ruby/test_call.rb
+  - test/ruby/test_signal.rb
+  - test/ruby/test_super.rb
+  - test/ruby/test_syntax.rb
+  - test/ruby/test_unicode_escape.rb
+  - test/rubygems/specifications/foo-0.0.1-x86-mswin32.gemspec
+  - trace_point.rb
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000000..57da742e5c
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,29 @@
+version: 2
+updates:
+  - package-ecosystem: 'github-actions'
+    directories:
+      - '/'
+      - '/.github/actions/slack'
+      - '/.github/actions/setup/directories'
+    schedule:
+      interval: 'daily'
+    groups:
+      github-actions:
+        patterns:
+          - "*"
+  - package-ecosystem: 'cargo'
+    directories:
+      - '/yjit'
+      - '/zjit'
+    exclude-paths:
+      - 'gc/mmtk/**'
+    schedule:
+      interval: 'monthly'
+    groups:
+      jit:
+        patterns:
+          - "*"
+  - package-ecosystem: 'vcpkg'
+    directory: '/'
+    schedule:
+      interval: 'daily'
diff --git a/.github/labeler.yml b/.github/labeler.yml
new file mode 100644
index 0000000000..f39fcec386
--- /dev/null
+++ b/.github/labeler.yml
@@ -0,0 +1,7 @@
+Documentation:
+- changed-files:
+  - all-globs-to-all-files: doc/**
+
+Backport:
+- base-branch: 'ruby_3_\d'
+- base-branch: 'ruby_4_\d'
diff --git a/.github/workflows/annocheck.yml b/.github/workflows/annocheck.yml
new file mode 100644
index 0000000000..1d23c38fcd
--- /dev/null
+++ b/.github/workflows/annocheck.yml
@@ -0,0 +1,111 @@
+name: Annocheck
+
+on:
+  push:
+    paths-ignore:
+      - 'doc/**'
+      - '**/man/*'
+      - '**.md'
+      - '**.rdoc'
+      - '**/.document'
+      - '.*.yml'
+  pull_request:
+    paths-ignore:
+      - 'doc/**'
+      - '**/man/*'
+      - '**.md'
+      - '**.rdoc'
+      - '**/.document'
+      - '.*.yml'
+  merge_group:
+
+concurrency:
+  group: ${{ github.workflow }} / ${{ startsWith(github.event_name, 'pull') && github.ref_name || github.sha }}
+  cancel-in-progress: ${{ startsWith(github.event_name, 'pull') }}
+
+permissions:
+  contents: read
+
+jobs:
+  compile:
+    name: test-annocheck
+
+    runs-on: ubuntu-latest
+
+    container:
+      image: ghcr.io/ruby/ruby-ci-image:gcc-11
+      options: --user root
+
+    if: >-
+      ${{!(false
+      || contains(github.event.head_commit.message, '[DOC]')
+      || contains(github.event.pull_request.title, '[DOC]')
+      || contains(github.event.pull_request.labels.*.name, 'Documentation')
+      || (github.event.pull_request.user.login == 'dependabot[bot]')
+      )}}
+
+    env:
+      CONFIGURE_TTY: never
+      GITPULLOPTIONS: --no-tags origin ${{ github.ref }}
+      RUBY_DEBUG: ci rgengc
+      RUBY_TESTOPTS: >-
+        -q
+        --color=always
+        --tty=no
+      # FIXME: Drop skipping options
+      # https://bugs.ruby-lang.org/issues/18061
+      # https://sourceware.org/annobin/annobin.html/Test-pie.html
+      TEST_ANNOCHECK_OPTS: '--skip-pie --skip-gaps'
+
+    steps:
+      - run: id
+        working-directory:
+
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          sparse-checkout-cone-mode: false
+          sparse-checkout: /.github
+          persist-credentials: false
+
+      - uses: ./.github/actions/setup/directories
+        with:
+          srcdir: src
+          builddir: build
+          makeup: true
+
+      - uses: ruby/setup-ruby@afeafc3d1ab54a631816aba4c914a0081c12ff2f # v1.310.0
+        with:
+          ruby-version: '3.1'
+          bundler: none
+
+      # Minimal flags to pass the check.
+      # -g0 disables backtraces when SEGV.  Do not set that.
+      - name: Run configure
+        run: >
+          ../src/configure -C
+          --enable-debug-env
+          --disable-install-doc
+          --with-ext=-test-/cxxanyargs,+
+          --without-valgrind
+          --without-jemalloc
+          --without-gmp
+          --with-gcc="gcc-11 -fcf-protection -Wa,--generate-missing-build-notes=yes"
+          --enable-shared
+          debugflags=-ggdb3
+          optflags=-O2
+          LDFLAGS=-Wl,-z,now
+
+      - run: make showflags
+
+      - run: make
+
+      - run: make test-annocheck
+
+      - uses: ./.github/actions/slack
+        with:
+          SLACK_WEBHOOK_URL: ${{ secrets.SIMPLER_ALERTS_URL }} # ruby-lang slack: ruby/simpler-alerts-bot
+        if: ${{ failure() }}
+
+defaults:
+  run:
+    working-directory: build
diff --git a/.github/workflows/auto_request_review.yml b/.github/workflows/auto_request_review.yml
new file mode 100644
index 0000000000..1be2b11b86
--- /dev/null
+++ b/.github/workflows/auto_request_review.yml
@@ -0,0 +1,20 @@
+name: Auto Request Review
+on:
+  pull_request_target:
+    types: [opened, ready_for_review, reopened]
+    branches: [master]
+
+permissions:
+  contents: read
+
+jobs:
+  auto-request-review:
+    name: Auto Request Review
+    runs-on: ubuntu-latest
+    if: ${{ github.repository == 'ruby/ruby' && github.base_ref == 'master' }}
+    steps:
+      - name: Request review based on files changes and/or groups the author belongs to
+        uses: necojackarc/auto-request-review@5d3060495e58e9cb41f51de50e808d3135d5374e # master
+        with:
+          # scope: public_repo
+          token: ${{ secrets.MATZBOT_AUTO_REQUEST_REVIEW_TOKEN }}
diff --git a/.github/workflows/auto_review_pr.yml b/.github/workflows/auto_review_pr.yml
new file mode 100644
index 0000000000..24859ad0b0
--- /dev/null
+++ b/.github/workflows/auto_review_pr.yml
@@ -0,0 +1,41 @@
+name: Auto Review PR
+on:
+  pull_request_target:
+    types: [opened, ready_for_review, reopened]
+    branches: [master]
+  workflow_dispatch:
+    inputs:
+      pr_number:
+        description: 'PR number to review'
+        required: true
+        type: number
+
+permissions:
+  contents: read
+
+jobs:
+  auto-review-pr:
+    name: Auto Review PR
+    runs-on: ubuntu-latest
+    if: ${{ github.repository == 'ruby/ruby' && (github.base_ref == 'master' || github.event_name == 'workflow_dispatch') }}
+
+    permissions:
+      pull-requests: write
+      contents: read
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - uses: ruby/setup-ruby@afeafc3d1ab54a631816aba4c914a0081c12ff2f # v1.310.0
+        with:
+          ruby-version: '3.4'
+          bundler: none
+
+      - name: Auto Review PR
+        run: ruby tool/auto_review_pr.rb "$GITHUB_PR_NUMBER"
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_PR_NUMBER: ${{ github.event.pull_request.number || github.event.inputs.pr_number }}
diff --git a/.github/workflows/baseruby.yml b/.github/workflows/baseruby.yml
new file mode 100644
index 0000000000..1acfbe19ac
--- /dev/null
+++ b/.github/workflows/baseruby.yml
@@ -0,0 +1,76 @@
+name: BASERUBY Check
+
+on:
+  push:
+    paths-ignore:
+      - 'doc/**'
+      - '**/man/*'
+      - '**.md'
+      - '**.rdoc'
+      - '**/.document'
+      - '.*.yml'
+  pull_request:
+    paths-ignore:
+      - 'doc/**'
+      - '**/man/*'
+      - '**.md'
+      - '**.rdoc'
+      - '**/.document'
+      - '.*.yml'
+  merge_group:
+
+concurrency:
+  group: ${{ github.workflow }} / ${{ startsWith(github.event_name, 'pull') && github.ref_name || github.sha }}
+  cancel-in-progress: ${{ startsWith(github.event_name, 'pull') }}
+
+permissions:
+  contents: read
+
+jobs:
+  baseruby:
+    name: BASERUBY
+
+    runs-on: ubuntu-22.04
+
+    if: >-
+      ${{!(false
+      || contains(github.event.head_commit.message, '[DOC]')
+      || contains(github.event.pull_request.title, '[DOC]')
+      || contains(github.event.pull_request.labels.*.name, 'Documentation')
+      || (github.event.pull_request.user.login == 'dependabot[bot]')
+      )}}
+
+    strategy:
+      matrix:
+        ruby:
+          - ruby-3.1
+          - ruby-3.2
+          - ruby-3.3
+
+    steps:
+      - uses: ruby/setup-ruby@afeafc3d1ab54a631816aba4c914a0081c12ff2f # v1.310.0
+        with:
+          ruby-version: ${{ matrix.ruby }}
+          bundler: none
+
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - uses: ./.github/actions/setup/ubuntu
+
+      - uses: ./.github/actions/setup/directories
+        with:
+          makeup: true
+
+      - run: ./configure --disable-install-doc
+
+      - run: make all
+
+      - run: make test
+
+      - uses: ./.github/actions/slack
+        with:
+          label: ${{ matrix.ruby }}
+          SLACK_WEBHOOK_URL: ${{ secrets.SIMPLER_ALERTS_URL }} # ruby-lang slack: ruby/simpler-alerts-bot
+        if: ${{ failure() }}
diff --git a/.github/workflows/bundled_gems.yml b/.github/workflows/bundled_gems.yml
new file mode 100644
index 0000000000..d890ed2495
--- /dev/null
+++ b/.github/workflows/bundled_gems.yml
@@ -0,0 +1,186 @@
+name: bundled_gems
+
+env:
+  UPDATE_ENABLED: true
+
+on:
+  push:
+    branches: ['master']
+    paths:
+      - '.github/workflows/bundled_gems.yml'
+      - 'gems/bundled_gems'
+  pull_request:
+    branches: ['master']
+    paths:
+      - '.github/workflows/bundled_gems.yml'
+      - 'gems/bundled_gems'
+  merge_group:
+  schedule:
+    - cron: '45 6 * * *'
+  workflow_dispatch:
+
+permissions: # added using https://github.com/step-security/secure-workflows
+  contents: read
+
+jobs:
+  update:
+    permissions:
+      contents: write # for Git to git push
+
+    if: ${{ github.event_name != 'schedule' || github.repository == 'ruby/ruby' }}
+
+    name: update ${{ github.workflow }}
+
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 # zizmor: ignore[artipacked]
+        with:
+          token: ${{ (github.repository == 'ruby/ruby' && !startsWith(github.event_name, 'pull')) && secrets.MATZBOT_AUTO_UPDATE_TOKEN || secrets.GITHUB_TOKEN }}
+
+      - uses: ruby/setup-ruby@afeafc3d1ab54a631816aba4c914a0081c12ff2f # v1.310.0
+        with:
+          ruby-version: 4.0
+
+      - uses: ./.github/actions/setup/directories
+        with:
+          # Skip overwriting MATZBOT_AUTO_UPDATE_TOKEN
+          checkout: '' # false (ref: https://github.com/actions/runner/issues/2238)
+
+      - name: Set ENV
+        run: |
+          echo "TODAY=$(date +%F)" >> $GITHUB_ENV
+
+      - name: Download previous gems list
+        run: |
+          mkdir -p .downloaded-cache
+          for data in bundled_gems.json default_gems.json; do
+            ln -s .downloaded-cache/$data .
+            curl --retry 5 --retry-connrefused --retry-delay 2 --retry-max-time 60 -O -R -z ./$data https://stdgems.org/$data
+          done
+
+      - name: Update bundled gems list
+        id: bundled_gems
+        run: |
+          ruby -i~ tool/update-bundled_gems.rb gems/bundled_gems >> $GITHUB_OUTPUT
+        if: ${{ env.UPDATE_ENABLED == 'true' }}
+
+      - name: Maintain updated gems list in NEWS
+        run: |
+          ruby tool/update-NEWS-gemlist.rb bundled
+          ruby tool/update-NEWS-github-release.rb --update
+        if: ${{ env.UPDATE_ENABLED == 'true' }}
+
+      - name: Check diffs
+        id: diff
+        run: |
+          news= gems=
+          git diff --color --no-ext-diff --ignore-submodules --exit-code -- NEWS.md ||
+          news=true
+          git diff --color --no-ext-diff --ignore-submodules --exit-code -- gems/bundled_gems ||
+          gems=true
+          git add -- NEWS.md gems/bundled_gems
+          echo news=$news >> $GITHUB_OUTPUT
+          echo gems=$gems >> $GITHUB_OUTPUT
+          echo update=${news:-$gems} >> $GITHUB_OUTPUT
+
+      - name: Commit
+        id: commit
+        run: |
+          git pull --ff-only origin ${GITHUB_REF#refs/heads/}
+          message="Update bundled gems list"
+          if [ -z "${gems}" ]; then
+            git commit --message="[DOC] ${message} at ${GITHUB_SHA:0:30}"
+          else
+            git commit --message="${message} as of ${TODAY}"
+          fi
+        env:
+          TODAY: ${{ steps.bundled_gems.outputs.latest_date || env.TODAY }}
+          EMAIL: svn-admin@ruby-lang.org
+          GIT_AUTHOR_NAME: git
+          GIT_COMMITTER_NAME: git
+          gems: ${{ steps.diff.outputs.gems }}
+        if: ${{ steps.diff.outputs.update }}
+
+      - name: Development revision of bundled gems
+        run: |
+          #!ruby
+          file = "gems/bundled_gems"
+
+          SECONDS_IN_DAY = 86400
+          today = Time.new("#{ENV['TODAY']}Z")
+          if !(december = today.month == 12)
+            days = 30
+          elsif (days = 26 - today.day).positive?
+            days += 4
+          else
+            puts "::info:: just after released"
+            exit
+          end
+
+          since = "#{today.year-1}-12-26"
+          ref = ENV['GITHUB_REF']
+          puts "::group::\e[94mfetching \e[1m#{file}\e[22m since \e[1m#{since}\e[22m from \e[1m#{ref}\e[m"
+          system(*%W[git fetch --shallow-since=#{since} --no-tags origin #{ref}], exception: true)
+          puts "::endgroup::"
+
+          puts "\e[94mchecking development version bundled gems older than \e[1m#{days}\e[22m days\e[m"
+          limit = today.to_i - days * SECONDS_IN_DAY
+          old = 0
+          IO.popen(%W"git blame --line-porcelain -- #{file}") do |blame|
+            while head = blame.gets("\n\t") and s = blame.gets
+              next unless (gem = s.split(/\s+|#.*/)).size > 3
+              time = head[/^committer-time \K\d+/].to_i
+              next if (d = limit - time) <= 0
+              d /= SECONDS_IN_DAY
+              line = head[/\A\h+ \d+ \K\d+/].to_i
+              level = if d < days; 'warning'; else old += 1; 'error'; end
+              d += days
+              puts "::#{level} file=#{file},line=#{line},title=Older than #{d} days::#{gem[0]} #{gem[3]}"
+            end
+          end
+          abort "::error title=Too long-standing gems::The release comes soon." if december and old.nonzero?
+        shell: ruby {0}
+        env:
+          file: ${{ steps.logs.outputs.file }}
+          days: ${{ steps.logs.outputs.days }}
+
+      - name: Install libraries
+        uses: ./.github/actions/setup/ubuntu
+        if: ${{ steps.diff.outputs.gems }}
+
+      - name: Build
+        run: |
+          ./autogen.sh
+          ./configure -C --disable-install-doc
+          make
+        if: ${{ steps.diff.outputs.gems }}
+
+      - name: Prepare bundled gems
+        run: |
+          make -s prepare-gems
+        if: ${{ steps.diff.outputs.gems }}
+
+      - name: Test bundled gems
+        run: |
+          make -s test-bundled-gems
+        timeout-minutes: 30
+        env:
+          RUBY_TESTOPTS: '-q --tty=no'
+          TEST_BUNDLED_GEMS_ALLOW_FAILURES: ''
+        if: ${{ steps.diff.outputs.gems }}
+
+      - name: Push
+        run: |
+          git push origin ${GITHUB_REF#refs/heads/}
+        if: >-
+          ${{
+          github.repository == 'ruby/ruby' &&
+          !startsWith(github.event_name, 'pull') &&
+          steps.commit.outcome == 'success'
+          }}
+
+      - uses: ./.github/actions/slack
+        with:
+          SLACK_WEBHOOK_URL: ${{ secrets.SIMPLER_ALERTS_URL }} # ruby-lang slack: ruby/simpler-alerts-bot
+        if: ${{ failure() }}
diff --git a/.github/workflows/check_branch.yml b/.github/workflows/check_branch.yml
deleted file mode 100644
index 37cf3a9a8f..0000000000
--- a/.github/workflows/check_branch.yml
+++ /dev/null
@@ -1,22 +0,0 @@
-# We bidirectionally synchronize github.com/ruby/ruby.git's master branch and
-# git.ruby-lang.org/ruby.git's master branch.
-# We can use a pull request's merge button only on the master branch.
-#
-# Therefore, we require to pass this "check_branch" on all protected branches
-# to prevent us from accidentally pushing commits to GitHub directly.
-#
-# Details: https://bugs.ruby-lang.org/issues/16094
-name: Pull Request
-on: [pull_request]
-jobs:
-  check_branch:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Check if branch is master
-        run: |
-          if [ "$BASE_REF" != master ]; then
-            echo "Only master branch accepts a pull request, but it's '$BASE_REF'."
-            exit 1
-          fi
-        env:
-          BASE_REF: ${{ github.base_ref }}
diff --git a/.github/workflows/check_dependencies.yml b/.github/workflows/check_dependencies.yml
new file mode 100644
index 0000000000..ad399b264f
--- /dev/null
+++ b/.github/workflows/check_dependencies.yml
@@ -0,0 +1,61 @@
+name: Check Dependencies
+on:
+  push:
+    paths-ignore:
+      - 'doc/**'
+      - '**/man/*'
+      - '**.md'
+      - '**.rdoc'
+      - '**/.document'
+      - '.*.yml'
+  pull_request:
+  merge_group:
+
+concurrency:
+  group: ${{ github.workflow }} / ${{ startsWith(github.event_name, 'pull') && github.ref_name || github.sha }}
+  cancel-in-progress: ${{ startsWith(github.event_name, 'pull') }}
+
+permissions:
+  contents: read
+
+jobs:
+  update-deps:
+    name: Dependency checks
+
+    strategy:
+      matrix:
+        os: [ubuntu-latest]
+      fail-fast: true
+
+    runs-on: ${{ matrix.os }}
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - uses: ./.github/actions/setup/ubuntu
+        if: ${{ contains(matrix.os, 'ubuntu') }}
+
+      - uses: ./.github/actions/setup/macos
+        if: ${{ contains(matrix.os, 'macos') }}
+
+      - uses: ./.github/actions/setup/directories
+
+      - uses: ruby/setup-ruby@afeafc3d1ab54a631816aba4c914a0081c12ff2f # v1.310.0
+        with:
+          ruby-version: '3.1'
+          bundler: none
+
+      - name: Run configure
+        run: ./configure -C --disable-install-doc --disable-rubygems --with-gcc 'optflags=-O0' 'debugflags=-save-temps=obj -g'
+
+      - run: make fix-depends
+
+      - run: git diff --color --no-ext-diff --ignore-submodules --exit-code
+
+      - uses: ./.github/actions/slack
+        with:
+          label: ${{ matrix.os }} / Dependencies need to update
+          SLACK_WEBHOOK_URL: ${{ secrets.SIMPLER_ALERTS_URL }} # ruby-lang slack: ruby/simpler-alerts-bot
+        if: ${{ failure() }}
diff --git a/.github/workflows/check_misc.yml b/.github/workflows/check_misc.yml
new file mode 100644
index 0000000000..f194d00779
--- /dev/null
+++ b/.github/workflows/check_misc.yml
@@ -0,0 +1,151 @@
+name: Misc
+on: [push, pull_request, merge_group]
+
+concurrency:
+  group: ${{ github.workflow }} / ${{ startsWith(github.event_name, 'pull') && github.ref_name || github.sha }}
+  cancel-in-progress: ${{ startsWith(github.event_name, 'pull') }}
+
+permissions:
+  contents: read
+
+jobs:
+  checks:
+    name: Miscellaneous checks
+
+    permissions:
+      contents: write # for Git to git push
+
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          token: ${{ (github.repository == 'ruby/ruby' && !startsWith(github.event_name, 'pull')) && secrets.MATZBOT_AUTO_UPDATE_TOKEN || secrets.GITHUB_TOKEN }}
+          persist-credentials: false
+
+      - uses: ruby/setup-ruby@afeafc3d1ab54a631816aba4c914a0081c12ff2f # v1.310.0
+        with:
+          ruby-version: head
+
+      - uses: ./.github/actions/setup/directories
+        with:
+          makeup: true
+          # Skip overwriting MATZBOT_AUTO_UPDATE_TOKEN
+          checkout: '' # false (ref: https://github.com/actions/runner/issues/2238)
+
+      - name: Re-generate Makefiles
+        run: |
+          # config.status needs to run as a shell script
+          { echo ':&&exit'; cat tool/prereq.status; } > config.status
+          : # same as actions/setup/directories/action.yml
+          for mk in Makefile GNUmakefile; do
+            sed -f tool/prereq.status template/$mk.in > $mk
+          done
+
+      - name: Check for code styles
+        run: |
+          set -x
+          ruby tool/auto-style.rb "$GITHUB_OLD_SHA" "$GITHUB_NEW_SHA"
+        env:
+          GITHUB_OLD_SHA: ${{ github.event.pull_request.base.sha }}
+          GITHUB_NEW_SHA: ${{ github.event.pull_request.merge_commit_sha }}
+        # Skip 'push' events because post_push.yml fixes them on push
+        if: ${{ github.repository == 'ruby/ruby' && startsWith(github.event_name, 'pull') }}
+
+      - name: Check if date in man pages is up-to-date
+        run: |
+          git fetch origin --depth=1 "${GITHUB_OLD_SHA}"
+          git diff --exit-code --name-only "${GITHUB_OLD_SHA}" HEAD -- man ||
+          make V=1 GIT=git BASERUBY=ruby update-man-date
+          git diff --color --no-ext-diff --ignore-submodules --exit-code -- man
+        env:
+          GITHUB_OLD_SHA: ${{ github.event.pull_request.base.sha }}
+        if: ${{ startsWith(github.event_name, 'pull') }}
+
+      - name: Check for bash specific substitution in configure.ac
+        run: |
+          git grep -n '\${[A-Za-z_0-9]*/' -- configure.ac && exit 1 || :
+
+      - name: Check for header macros
+        run: |
+          fail=
+          for header in ruby/*.h; do
+            git grep -l -F -e $header -e HAVE_`echo $header | tr a-z./ A-Z__` -- . > /dev/null && continue
+            fail=1
+            echo $header
+          done
+          exit $fail
+        working-directory: include
+
+      - id: now
+        run: |
+          date +"mon=%-m"%n"day=%-d" >> $GITHUB_OUTPUT
+        env:
+          TZ: Asia/Tokyo
+
+      - id: deprecation
+        run: |
+          eval $(sed -n 's/^#define RUBY_API_VERSION_\(MAJOR\|MINOR\) /\1=/p' include/ruby/version.h)
+          if git --no-pager grep --color -o 'rb_warn_deprecated_to_remove_at('$MAJOR'\.'$MINOR',.*' -- '*.c' >&2; then
+              false
+          else
+              true
+          fi
+        continue-on-error: ${{ steps.now.outputs.mon < 12 }}
+
+      - name: Check if to generate documents
+        id: rdoc
+        run: |
+          set -- $(sed 's/#.*//;/^rdoc /!d' gems/bundled_gems)
+          { echo version=$2; echo ref=$4; } >> $GITHUB_OUTPUT
+
+      - name: Checkout rdoc
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          repository: ruby/rdoc
+          ref: ${{ steps.rdoc.outputs.ref }}
+          path: .bundle/gems/rdoc-${{ steps.rdoc.outputs.version }}
+          persist-credentials: false
+        if: ${{ steps.rdoc.outputs.ref != '' }}
+
+      - name: Generate rdoc scripts
+        run: |
+          set -x
+          gempath=$(ruby -e 'print Gem.user_dir, "/bin"')
+          PATH=$gempath:$PATH
+          gem install --user bundler
+          bundle config --local path vendor/bundle
+          bundle install --jobs 4
+          bundle exec rake generate
+        working-directory: .bundle/gems/rdoc-${{ steps.rdoc.outputs.version }}
+        if: ${{ steps.rdoc.outputs.ref != '' }}
+
+      - name: Core docs coverage
+        run: |
+          make XRUBY=ruby RDOC_DEPENDS= RBCONFIG=update-rbconfig rdoc-coverage
+
+      - name: Generate docs
+        id: docs
+        run: |
+          make XRUBY=ruby RDOC_DEPENDS= RBCONFIG=update-rbconfig HTMLOUT=html html
+          echo htmlout=ruby-html-${GITHUB_SHA:0:10} >> $GITHUB_OUTPUT
+        # Generate only when document commit/PR
+        if: >-
+          ${{false
+          || contains(github.event.head_commit.message, '[ruby/rdoc]')
+          || contains(github.event.head_commit.message, '[DOC]')
+          || contains(github.event.pull_request.title, '[DOC]')
+          || contains(github.event.pull_request.labels.*.name, 'Documentation')
+          }}
+
+      - name: Upload docs
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          path: html
+          name: ${{ steps.docs.outputs.htmlout }}
+        if: ${{ steps.docs.outcome == 'success' }}
+
+      - uses: ./.github/actions/slack
+        with:
+          SLACK_WEBHOOK_URL: ${{ secrets.SIMPLER_ALERTS_URL }} # ruby-lang slack: ruby/simpler-alerts-bot
+        if: ${{ failure() }}
diff --git a/.github/workflows/check_sast.yml b/.github/workflows/check_sast.yml
new file mode 100644
index 0000000000..6fd1be6542
--- /dev/null
+++ b/.github/workflows/check_sast.yml
@@ -0,0 +1,133 @@
+name: 'Check SAST tool'
+
+on:
+  push:
+    branches: ['master']
+    paths-ignore:
+      - 'doc/**'
+      - '**/man/*'
+      - '**.md'
+      - '**.rdoc'
+      - '**/.document'
+      - '.*.yml'
+  pull_request:
+    paths-ignore:
+      - 'doc/**'
+      - '**/man/*'
+      - '**.md'
+      - '**.rdoc'
+      - '**/.document'
+      - '.*.yml'
+  schedule:
+    - cron: '0 12 * * *'
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }} / ${{ startsWith(github.event_name, 'pull') && github.ref_name || github.sha }}
+  cancel-in-progress: ${{ startsWith(github.event_name, 'pull') }}
+
+permissions: # added using https://github.com/step-security/secure-workflows
+  contents: read
+
+jobs:
+  zizmor:
+    name: zizmor
+
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+      security-events: write
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Run zizmor
+        uses: zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d # v0.5.6
+        continue-on-error: true
+
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read # for github/codeql-action/init to get workflow details
+      contents: read # for actions/checkout to fetch code
+      security-events: write # for github/codeql-action/upload-sarif to send a status report
+    # CodeQL fails to run pull requests from dependabot due to missing write access to upload results.
+    if: >-
+      ${{!(false
+      || contains(github.event.head_commit.message, '[DOC]')
+      || contains(github.event.pull_request.title, '[DOC]')
+      || contains(github.event.pull_request.labels.*.name, 'Documentation')
+      || (github.event.pull_request.user.login == 'dependabot[bot]')
+      )}}
+
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - language: cpp
+          - language: ruby
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0
+        with:
+          languages: ${{ matrix.language }}
+          build-mode: none
+          config-file: .github/codeql/codeql-config.yml
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0
+        with:
+          category: '/language:${{ matrix.language }}'
+          upload: False
+          output: sarif-results
+
+      - name: filter-sarif
+        uses: advanced-security/filter-sarif@2da736ff05ef065cb2894ac6892e47b5eac2c3c0 # v1.1
+        with:
+          patterns: |
+            +**/*.rb
+            -lib/uri/mailto.rb:rb/overly-large-range
+            -lib/uri/rfc3986_parser.rb:rb/overly-large-range
+            -lib/bundler/vendor/uri/lib/uri/mailto.rb:rb/overly-large-range
+            -lib/bundler/vendor/uri/lib/uri/rfc3986_parser.rb:rb/overly-large-range
+            -spec/ruby/core/regexp/timeout_spec.rb:rb/redos
+            -test/ruby/test_io.rb:rb/non-constant-kernel-open
+            -test/open-uri/test_open-uri.rb:rb/non-constant-kernel-open
+            -test/open-uri/test_ssl.rb:rb/non-constant-kernel-open
+            -spec/ruby/core/io/binread_spec.rb:rb/non-constant-kernel-open
+            -spec/ruby/core/io/readlines_spec.rb:rb/non-constant-kernel-open
+            -spec/ruby/core/io/foreach_spec.rb:rb/non-constant-kernel-open
+            -spec/ruby/core/io/write_spec.rb:rb/non-constant-kernel-open
+            -spec/ruby/core/io/read_spec.rb:rb/non-constant-kernel-open
+            -spec/ruby/core/kernel/open_spec.rb:rb/non-constant-kernel-open
+          input: sarif-results/${{ matrix.language }}.sarif
+          output: sarif-results/${{ matrix.language }}.sarif
+        if: ${{ matrix.language == 'ruby' }}
+        continue-on-error: true
+
+      - name: filter-sarif
+        uses: advanced-security/filter-sarif@2da736ff05ef065cb2894ac6892e47b5eac2c3c0 # v1.1
+        with:
+          patterns: |
+            +**/*.c
+            +**/*.h
+          input: sarif-results/${{ matrix.language }}.sarif
+          output: sarif-results/${{ matrix.language }}.sarif
+        if: ${{ matrix.language == 'cpp' }}
+        continue-on-error: true
+
+      - name: Upload SARIF
+        uses: github/codeql-action/upload-sarif@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0
+        with:
+          sarif_file: sarif-results/${{ matrix.language }}.sarif
+        continue-on-error: true
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
deleted file mode 100644
index b571409abf..0000000000
--- a/.github/workflows/codeql-analysis.yml
+++ /dev/null
@@ -1,39 +0,0 @@
-name: "Code scanning - action"
-
-on:
-  push:
-  pull_request:
-  schedule:
-    - cron: '0 12 * * 4'
-
-jobs:
-  CodeQL-Build:
-
-    # CodeQL runs on ubuntu-latest and windows-latest
-    runs-on: ubuntu-latest
-
-    steps:
-    - name: Install libraries
-      run: |
-        set -x
-        sudo apt-get update -q || :
-        sudo apt-get install --no-install-recommends -q -y build-essential libssl-dev libyaml-dev libreadline6-dev zlib1g-dev libncurses5-dev libffi-dev libgdbm-dev bison autoconf ruby
-
-    - name: Checkout repository
-      uses: actions/checkout@v2
-      with:
-        fetch-depth: 2
-
-    - run: git checkout HEAD^2
-      if: ${{ github.event_name == 'pull_request' }}
-
-    - name: Initialize CodeQL
-      uses: github/codeql-action/init@v1
-      with:
-        languages: cpp
-
-    - name: Autobuild
-      uses: github/codeql-action/autobuild@v1
-
-    - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v1
diff --git a/.github/workflows/compilers.yml b/.github/workflows/compilers.yml
index 6925477aaf..147470f38a 100644
--- a/.github/workflows/compilers.yml
+++ b/.github/workflows/compilers.yml
@@ -1,201 +1,333 @@
+# Some tests depending on this name 'Compilations' via $GITHUB_WORKFLOW. Make sure to update such tests when renaming this workflow.
 name: Compilations
 
-on: [push, pull_request]
-
-# Github actions does not support YAML anchors.  This creative use of
-# environment variables (plus the "echo ::set-env" hack) is to reroute that
-# restriction.
-env:
-  default_cc: clang-11
-  append_cc: ''
-
-  # -O1 is faster than -O3 in our tests... Majority of time are consumed trying
-  # to optimize binaries.  Also Github Actions runs on a relatively modern CPU
-  # compared to, say, GCC 4 or Clang 3.  We don't specify `-march=native`
-  # because compilers tend not understand what the CPU is.
-  optflags: '-O1 -march=x86-64 -mtune=generic'
-
-  # -g0 disables backtraces when SEGV.  Do not set that.
-  debugflags: '-ggdb3'
-
-  default_configure: >-
-    --enable-debug-env
-    --disable-install-doc
-    --with-ext=-test-/cxxanyargs,+
-  append_configure: >-
-    --without-valgrind
-    --without-jemalloc
-    --without-gmp
-
-  UPDATE_UNICODE: >-
-    UNICODE_FILES=.
-    UNICODE_PROPERTY_FILES=.
-    UNICODE_AUXILIARY_FILES=.
-    UNICODE_EMOJI_FILES=.
-  CONFIGURE_TTY: never
-  GITPULLOPTIONS: --no-tags origin ${{github.ref}}
-  RUBY_DEBUG: ci rgengc
-  RUBY_TESTOPTS: >-
-    -q
-    --color=always
-    --tty=no
+on:
+  push:
+    paths-ignore:
+      - 'doc/**'
+      - '**/man/*'
+      - '**.md'
+      - '**.rdoc'
+      - '**/.document'
+      - '.*.yml'
+  pull_request:
+    paths-ignore:
+      - 'doc/**'
+      - '**/man/*'
+      - '**.md'
+      - '**.rdoc'
+      - '**/.document'
+      - '.*.yml'
+  merge_group:
 
+concurrency:
+  group: ${{ github.workflow }} / ${{ startsWith(github.event_name, 'pull') && github.ref_name || github.sha }}
+  cancel-in-progress: ${{ startsWith(github.event_name, 'pull') }}
+
+permissions:
+  contents: read
+
+# Each job is split so that they roughly take 30min to run through.
 jobs:
-  compile:
-    strategy:
-      fail-fast: false
-      matrix:
-        entry:
-          - { key: default_cc, name: gcc-10,    value: gcc-10 }
-          - { key: default_cc, name: gcc-9,     value: gcc-9 }
-          - { key: default_cc, name: gcc-8,     value: gcc-8 }
-          - { key: default_cc, name: gcc-7,     value: gcc-7 }
-          - { key: default_cc, name: gcc-6,     value: gcc-6 }
-          - { key: default_cc, name: gcc-5,     value: gcc-5 }
-          - { key: default_cc, name: gcc-4.8,   value: gcc-4.8 }
-          - { key: default_cc, name: clang-11,  value: clang-11 }
-          - { key: default_cc, name: clang-10,  value: clang-10 }
-          - { key: default_cc, name: clang-9,   value: clang-9 }
-          - { key: default_cc, name: clang-8,   value: clang-8 }
-          - { key: default_cc, name: clang-7,   value: clang-7 }
-          - { key: default_cc, name: clang-6.0, value: clang-6.0 }
-          - { key: default_cc, name: clang-5.0, value: clang-5.0 }
-          - { key: default_cc, name: clang-4.0, value: clang-4.0 }
-          - { key: default_cc, name: clang-3.9, value: clang-3.9 }
-
-          - { key: append_cc, name: c99,   value: '-std=c99   -Werror=pedantic -pedantic-errors' }
-          - { key: append_cc, name: c11,   value: '-std=c11   -Werror=pedantic -pedantic-errors' }
-          - { key: append_cc, name: c17,   value: '-std=c17   -Werror=pedantic -pedantic-errors' }
-          - { key: append_cc, name: c2x,   value: '-std=c2x   -Werror=pedantic -pedantic-errors' }
-          - { key: CXXFLAGS,  name: c++98, value: '-std=c++98 -Werror=pedantic -pedantic-errors -Wno-c++11-long-long' }
-          - { key: CXXFLAGS,  name: c++11, value: '-std=c++11 -Werror=pedantic -pedantic-errors -Wno-c++11-long-long' }
-          - { key: CXXFLAGS,  name: c++14, value: '-std=c++14 -Werror=pedantic -pedantic-errors -Wno-c++11-long-long' }
-          - { key: CXXFLAGS,  name: c++17, value: '-std=c++17 -Werror=pedantic -pedantic-errors -Wno-c++11-long-long' }
-          - { key: CXXFLAGS,  name: c++2a, value: '-std=c++2a -Werror=pedantic -pedantic-errors -Wno-c++11-long-long' }
-
-          - { key: optflags, name: '-O0', value: '-O0 -march=x86-64 -mtune=generic' }
-          - { key: optflags, name: '-O3', value: '-O3 -march=x86-64 -mtune=generic' }
-
-          - { key: append_configure, name: gmp,                  value: '--with-gmp' }
-          - { key: append_configure, name: jemalloc,             value: '--with-jemalloc' }
-          - { key: append_configure, name: valgrind,             value: '--with-valgrind' }
-          - { key: append_configure, name: 'coroutine=ucontext', value: '--with-coroutine=ucontext' }
-          - { key: append_configure, name: 'coroutine=copy',     value: '--with-coroutine=copy' }
-          - { key: append_configure, name: disable-mathn,        value: '--disable-mathn' }
-          - { key: append_configure, name: disable-jit-support,  value: '--disable-jit-support' }
-          - { key: append_configure, name: disable-dln,          value: '--disable-dln' }
-          - { key: append_configure, name: disable-rubygems,     value: '--disable-rubygems' }
-
-          - { key: cppflags, name: OPT_THREADED_CODE=1,            value: '-DOPT_THREADED_CODE=1' }
-          - { key: cppflags, name: OPT_THREADED_CODE=2,            value: '-DOPT_THREADED_CODE=2' }
-          - { key: cppflags, name: OPT_THREADED_CODE=3,            value: '-DOPT_THREADED_CODE=3' }
-
-          - { key: cppflags, name: NDEBUG,                         value: '-DNDEBUG' }
-          - { key: cppflags, name: RUBY_DEBUG,                     value: '-DRUBY_DEBUG' }
-          - { key: cppflags, name: ARRAY_DEBUG,                    value: '-DARRAY_DEBUG' }
-          - { key: cppflags, name: BIGNUM_DEBUG,                   value: '-DBIGNUM_DEBUG' }
-          - { key: cppflags, name: CCAN_LIST_DEBUG,                value: '-DCCAN_LIST_DEBUG' }
-          - { key: cppflags, name: CPDEBUG=-1,                     value: '-DCPDEBUG=-1' }
-          - { key: cppflags, name: ENC_DEBUG,                      value: '-DENC_DEBUG' }
-          - { key: cppflags, name: GC_DEBUG,                       value: '-DGC_DEBUG' }
-          - { key: cppflags, name: HASH_DEBUG,                     value: '-DHASH_DEBUG' }
-          - { key: cppflags, name: ID_TABLE_DEBUG,                 value: '-DID_TABLE_DEBUG' }
-          - { key: cppflags, name: RGENGC_DEBUG=-1,                value: '-DRGENGC_DEBUG=-1' }
-          - { key: cppflags, name: SYMBOL_DEBUG,                   value: '-DSYMBOL_DEBUG' }
-          - { key: cppflags, name: THREAD_DEBUG=-1,                value: '-DTHREAD_DEBUG=-1' }
-
-          - { key: cppflags, name: RGENGC_CHECK_MODE,              value: '-DRGENGC_CHECK_MODE' }
-          - { key: cppflags, name: TRANSIENT_HEAP_CHECK_MODE,      value: '-DTRANSIENT_HEAP_CHECK_MODE' }
-          - { key: cppflags, name: VM_CHECK_MODE,                  value: '-DVM_CHECK_MODE' }
-
-          - { key: cppflags, name: USE_EMBED_CI=0,                 value: '-DUSE_EMBED_CI=0' }
-          - { key: cppflags, name: USE_FLONUM=0,                   value: '-DUSE_FLONUM=0' }
-#         - { key: cppflags, name: USE_GC_MALLOC_OBJ_INFO_DETAILS, value: '-DUSE_GC_MALLOC_OBJ_INFO_DETAILS' }
-          - { key: cppflags, name: USE_LAZY_LOAD,                  value: '-DUSE_LAZY_LOAD' }
-          - { key: cppflags, name: USE_RINCGC=0,                   value: '-DUSE_RINCGC=0' }
-          - { key: cppflags, name: USE_SYMBOL_GC=0,                value: '-DUSE_SYMBOL_GC=0' }
-          - { key: cppflags, name: USE_THREAD_CACHE=0,             value: '-DUSE_THREAD_CACHE=0' }
-          - { key: cppflags, name: USE_TRANSIENT_HEAP=0,           value: '-DUSE_TRANSIENT_HEAP=0' }
-
-          - { key: cppflags, name: DEBUG_FIND_TIME_NUMGESS,        value: '-DDEBUG_FIND_TIME_NUMGESS' }
-          - { key: cppflags, name: DEBUG_INTEGER_PACK,             value: '-DDEBUG_INTEGER_PACK' }
-          - { key: cppflags, name: ENABLE_PATH_CHECK,              value: '-DENABLE_PATH_CHECK' }
-
-          - { key: cppflags, name: GC_DEBUG_STRESS_TO_CLASS,       value: '-DGC_DEBUG_STRESS_TO_CLASS' }
-          - { key: cppflags, name: GC_ENABLE_LAZY_SWEEP=0,         value: '-DGC_ENABLE_LAZY_SWEEP=0' }
-          - { key: cppflags, name: GC_PROFILE_DETAIL_MEMOTY,       value: '-DGC_PROFILE_DETAIL_MEMOTY' }
-          - { key: cppflags, name: GC_PROFILE_MORE_DETAIL,         value: '-DGC_PROFILE_MORE_DETAIL' }
-
-          - { key: cppflags, name: CALC_EXACT_MALLOC_SIZE,         value: '-DCALC_EXACT_MALLOC_SIZE' }
-          - { key: cppflags, name: MALLOC_ALLOCATED_SIZE_CHECK,    value: '-DMALLOC_ALLOCATED_SIZE_CHECK' }
-
-          - { key: cppflags, name: IBF_ISEQ_ENABLE_LOCAL_BUFFER,   value: '-DIBF_ISEQ_ENABLE_LOCAL_BUFFER' }
-
-          - { key: cppflags, name: RGENGC_ESTIMATE_OLDMALLOC,      value: '-DRGENGC_ESTIMATE_OLDMALLOC' }
-          - { key: cppflags, name: RGENGC_FORCE_MAJOR_GC,          value: '-DRGENGC_FORCE_MAJOR_GC' }
-          - { key: cppflags, name: RGENGC_OBJ_INFO,                value: '-DRGENGC_OBJ_INFO' }
-          - { key: cppflags, name: RGENGC_OLD_NEWOBJ_CHECK,        value: '-DRGENGC_OLD_NEWOBJ_CHECK' }
-          - { key: cppflags, name: RGENGC_PROFILE,                 value: '-DRGENGC_PROFILE' }
-
-          - { key: cppflags, name: VM_DEBUG_BP_CHECK,              value: '-DVM_DEBUG_BP_CHECK' }
-          - { key: cppflags, name: VM_DEBUG_VERIFY_METHOD_CACHE,   value: '-DVM_DEBUG_VERIFY_METHOD_CACHE' }
-
-          - { key: cppflags, name: MJIT_FORCE_ENABLE,              value: '-DMJIT_FORCE_ENABLE' }
-
-    name: ${{ matrix.entry.name }}
+  compile-if:
+    name: 'omnibus compilations, trigger'
     runs-on: ubuntu-latest
-    container: shyouhei/c-compilers:latest
-    if: "!contains(github.event.head_commit.message, '[ci skip]')"
+    if: >-
+      ${{!(false
+      || contains(github.event.head_commit.message, '[DOC]')
+      || contains(github.event.pull_request.title, '[DOC]')
+      || contains(github.event.pull_request.labels.*.name, 'Documentation')
+      || (github.event.pull_request.user.login == 'dependabot[bot]')
+      )}}
     steps:
-      - name: setenv
-        run: |
-          echo ::set-env name=${{ matrix.entry.key }}::${{ matrix.entry.value }}
-          echo ::set-env name=make::make -sj$((1 + $(nproc --all)))
-      - run: mkdir build
-      - uses: actions/checkout@v2
+      - run: true
+        working-directory:
+
+  compile1:
+    name: 'omnibus compilations, #1'
+    runs-on: ubuntu-latest
+    needs: compile-if
+    if: ${{ needs.compile-if.result == 'success' }}
+    timeout-minutes: 60
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with: { sparse-checkout-cone-mode: false, sparse-checkout: /.github, persist-credentials: false }
+      # Set fetch-depth: 10 so that Launchable can receive commits information.
+      - { uses: './.github/actions/setup/directories', with: { srcdir: 'src', builddir: 'build', makeup: true, fetch-depth: 10 } }
+      - name: 'clang 22 LTO'
+        uses: './.github/actions/compilers'
         with:
-          path: src
-      - run: autoconf
-        working-directory: src
-      - name: Run configure
-        working-directory: build
-        run: |
-          ../src/configure -C \
-            ${default_configure} \
-            ${append_configure} \
-            --with-gcc="${default_cc} ${append_cc}"
-      - run: $make incs
-        working-directory: build
-      - run: $make
-        working-directory: build
-      - run: $make test
-        working-directory: build
-      - run: $make install
-        working-directory: build
-        if: "matrix.entry.name == '-O3'"
-      - run: /usr/local/bin/gem install --no-doc timezone tzinfo
-        working-directory: build
-        if: "matrix.entry.name == '-O3'"
-      - run: $make test-tool
-        working-directory: build
-        if: "matrix.entry.name == '-O3'"
-      - run: $make test-all TESTS='-- ruby -ext-'
-        working-directory: build
-        if: "matrix.entry.name == '-O3'"
-      - run: $make test-spec
-        working-directory: build
-        if: "matrix.entry.name == '-O3'"
-
-      - uses: k0kubun/action-slack@v2.0.0
+          tag: clang-22
+          with_gcc: 'clang-22 -flto=auto'
+          optflags: '-O2'
+          enable_shared: false
+        timeout-minutes: 30
+      - { uses: './.github/actions/compilers', name: '-O0', with: { optflags: '-O0 -march=x86-64 -mtune=generic' }, timeout-minutes: 5 }
+      # - { uses: './.github/actions/compilers', name: '-O3', with: { optflags: '-O3 -march=x86-64 -mtune=generic', check: true } }
+
+  compile2:
+    name: 'omnibus compilations, #2'
+    runs-on: ubuntu-latest
+    needs: compile-if
+    if: ${{ needs.compile-if.result == 'success' }}
+    timeout-minutes: 60
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with: { sparse-checkout-cone-mode: false, sparse-checkout: /.github, persist-credentials: false }
+      - { uses: './.github/actions/setup/directories', with: { srcdir: 'src', builddir: 'build', makeup: true, fetch-depth: 10 } }
+      - name: 'GCC 15 LTO'
+        uses: './.github/actions/compilers'
         with:
-          payload: |
-            {
-              "ci": "GitHub Actions",
-              "env": "${{ github.workflow }} / ${{ matrix.entry.name }}",
-              "url": "https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}",
-              "commit": "${{ github.sha }}",
-              "branch": "${{ github.ref }}".split('/').reverse()[0]
-            }
-        env:
+          tag: gcc-15
+          with_gcc: 'gcc-15 -flto=auto -ffat-lto-objects -Werror=lto-type-mismatch'
+          optflags: '-O2'
+          enable_shared: false
+        timeout-minutes: 10
+      - { uses: './.github/actions/compilers', name: 'ext/Setup', with: { static_exts: 'etc json/* */escape' }, timeout-minutes: 5 }
+      - { uses: './.github/actions/compilers', name: 'GCC 15', with: { tag: 'gcc-15' }, timeout-minutes: 5 }
+      - { uses: './.github/actions/compilers', name: 'GCC 14', with: { tag: 'gcc-14' }, timeout-minutes: 5 }
+      - { uses: './.github/actions/compilers', name: 'GCC 13', with: { tag: 'gcc-13' }, timeout-minutes: 5 }
+      - { uses: './.github/actions/compilers', name: 'GCC 12', with: { tag: 'gcc-12' }, timeout-minutes: 5 }
+      - { uses: './.github/actions/compilers', name: 'GCC 11', with: { tag: 'gcc-11' }, timeout-minutes: 5 }
+      - { uses: './.github/actions/compilers', name: 'GCC 10', with: { tag: 'gcc-10' }, timeout-minutes: 5 }
+      - { uses: './.github/actions/compilers', name: 'GCC 9',  with: { tag: 'gcc-9'  }, timeout-minutes: 5 }
+
+  compile3:
+    name: 'omnibus compilations, #3'
+    runs-on: ubuntu-latest
+    needs: compile-if
+    if: ${{ needs.compile-if.result == 'success' }}
+    timeout-minutes: 60
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with: { sparse-checkout-cone-mode: false, sparse-checkout: /.github, persist-credentials: false }
+      - { uses: './.github/actions/setup/directories', with: { srcdir: 'src', builddir: 'build', makeup: true, fetch-depth: 10 } }
+      - { uses: './.github/actions/compilers', name: 'clang 20', with: { tag: 'clang-20' }, timeout-minutes: 5 }
+      - { uses: './.github/actions/compilers', name: 'clang 19', with: { tag: 'clang-19' }, timeout-minutes: 5 }
+      - { uses: './.github/actions/compilers', name: 'clang 18', with: { tag: 'clang-18' }, timeout-minutes: 5 }
+      - { uses: './.github/actions/compilers', name: 'clang 17', with: { tag: 'clang-17' }, timeout-minutes: 5 }
+      - { uses: './.github/actions/compilers', name: 'clang 16', with: { tag: 'clang-16' }, timeout-minutes: 5 }
+      - { uses: './.github/actions/compilers', name: 'clang 15', with: { tag: 'clang-15' }, timeout-minutes: 5 }
+      - { uses: './.github/actions/compilers', name: 'clang 14', with: { tag: 'clang-14' }, timeout-minutes: 5 }
+
+  compile4:
+    name: 'omnibus compilations, #4'
+    runs-on: ubuntu-latest
+    needs: compile-if
+    if: ${{ needs.compile-if.result == 'success' }}
+    timeout-minutes: 60
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with: { sparse-checkout-cone-mode: false, sparse-checkout: /.github, persist-credentials: false }
+      - { uses: './.github/actions/setup/directories', with: { srcdir: 'src', builddir: 'build', makeup: true, fetch-depth: 10 } }
+      - { uses: './.github/actions/compilers', name: 'clang 13', with: { tag: 'clang-13' }, timeout-minutes: 5 }
+      - { uses: './.github/actions/compilers', name: 'clang 12', with: { tag: 'clang-12' }, timeout-minutes: 5 }
+      - { uses: './.github/actions/compilers', name: 'clang 11', with: { tag: 'clang-11' }, timeout-minutes: 5 }
+      - { uses: './.github/actions/compilers', name: 'clang 10', with: { tag: 'clang-10' }, timeout-minutes: 5 }
+        # llvm-objcopy<=9 doesn't have --wildcard. It compiles, but leaves Rust symbols in libyjit.o and fail `make test-leaked-globals`.
+      - { uses: './.github/actions/compilers', name: 'clang 9',  with: { tag: 'clang-9',   append_configure: '--disable-yjit --disable-zjit' }, timeout-minutes: 5 }
+      - { uses: './.github/actions/compilers', name: 'clang 8',  with: { tag: 'clang-8',   append_configure: '--disable-yjit --disable-zjit' }, timeout-minutes: 5 }
+      - { uses: './.github/actions/compilers', name: 'clang 7',  with: { tag: 'clang-7',   append_configure: '--disable-yjit --disable-zjit' }, timeout-minutes: 5 }
+      - { uses: './.github/actions/compilers', name: 'clang 6',  with: { tag: 'clang-6.0', append_configure: '--disable-yjit --disable-zjit' }, timeout-minutes: 5 }
+
+  compile5:
+    name: 'omnibus compilations, #5'
+    runs-on: ubuntu-latest
+    needs: compile-if
+    if: ${{ needs.compile-if.result == 'success' }}
+    timeout-minutes: 60
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with: { sparse-checkout-cone-mode: false, sparse-checkout: /.github, persist-credentials: false }
+      - { uses: './.github/actions/setup/directories', with: { srcdir: 'src', builddir: 'build', makeup: true, fetch-depth: 10 } }
+      # -Wno-strict-prototypes is necessary with current clang-15 since
+      # older autoconf generate functions without prototype and -pedantic
+      # now implies strict-prototypes. Disabling the error but leaving the
+      # warning generates a lot of noise from use of ANYARGS in
+      # rb_define_method() and friends.
+      # See: https://github.com/llvm/llvm-project/commit/11da1b53d8cd3507959022cd790d5a7ad4573d94
+      - { uses: './.github/actions/compilers', name: 'C99',      with: { CFLAGS: '-std=c99 -Werror=pedantic -pedantic-errors -Wno-strict-prototypes' }, timeout-minutes: 5 }
+      - { uses: './.github/actions/compilers', name: 'C11',   with: { CFLAGS:   '-std=c11   -Werror=pedantic -pedantic-errors -Wno-strict-prototypes' }, timeout-minutes: 5 }
+      - { uses: './.github/actions/compilers', name: 'C17',   with: { CFLAGS:   '-std=c17   -Werror=pedantic -pedantic-errors -Wno-strict-prototypes' }, timeout-minutes: 5 }
+      - { uses: './.github/actions/compilers', name: 'C23',   with: { CFLAGS:   '-std=c2x   -Werror=pedantic -pedantic-errors -Wno-strict-prototypes' }, timeout-minutes: 5 }
+      - { uses: './.github/actions/compilers', name: 'C++98', with: { CXXFLAGS: '-std=c++98 -Werror=pedantic -pedantic-errors -Wno-c++11-long-long' }, timeout-minutes: 5 }
+      - { uses: './.github/actions/compilers', name: 'C++11', with: { CXXFLAGS: '-std=c++11 -Werror=pedantic -pedantic-errors -Wno-c++11-long-long' }, timeout-minutes: 5 }
+      - { uses: './.github/actions/compilers', name: 'C++14', with: { CXXFLAGS: '-std=c++14 -Werror=pedantic -pedantic-errors -Wno-c++11-long-long' }, timeout-minutes: 5 }
+      - { uses: './.github/actions/compilers', name: 'C++17', with: { CXXFLAGS: '-std=c++17 -Werror=pedantic -pedantic-errors -Wno-c++11-long-long' }, timeout-minutes: 5 }
+
+  compile6:
+    name: 'omnibus compilations, #6'
+    runs-on: ubuntu-latest
+    needs: compile-if
+    if: ${{ needs.compile-if.result == 'success' }}
+    timeout-minutes: 60
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with: { sparse-checkout-cone-mode: false, sparse-checkout: /.github, persist-credentials: false }
+      - { uses: './.github/actions/setup/directories', with: { srcdir: 'src', builddir: 'build', makeup: true, fetch-depth: 10 } }
+      - { uses: './.github/actions/compilers', name: 'C++20', with: { CXXFLAGS: '-std=c++20 -Werror=pedantic -pedantic-errors -Wno-c++11-long-long' }, timeout-minutes: 5 }
+      - { uses: './.github/actions/compilers', name: 'C++23', with: { CXXFLAGS: '-std=c++23 -Werror=pedantic -pedantic-errors -Wno-c++11-long-long' }, timeout-minutes: 5 }
+      - { uses: './.github/actions/compilers', name: 'C++26', with: { CXXFLAGS: '-std=c++26 -Werror=pedantic -pedantic-errors -Wno-c++11-long-long' }, timeout-minutes: 5 }
+      - { uses: './.github/actions/compilers', name: 'gmp',                 with: { append_configure: '--with-gmp', test_all: 'ruby/test_bignum.rb', test_spec: "/github/workspace/src/spec/ruby/core/integer" }, timeout-minutes: 5 }
+      - { uses: './.github/actions/compilers', name: 'jemalloc',            with: { append_configure: '--with-jemalloc' }, timeout-minutes: 5 }
+      - { uses: './.github/actions/compilers', name: 'valgrind',            with: { append_configure: '--with-valgrind' }, timeout-minutes: 5 }
+      - { uses: './.github/actions/compilers', name: 'coroutine=ucontext',  with: { append_configure: '--with-coroutine=ucontext' }, timeout-minutes: 5 }
+      - { uses: './.github/actions/compilers', name: 'coroutine=pthread',   with: { append_configure: '--with-coroutine=pthread' }, timeout-minutes: 5 }
+
+  compile7:
+    name: 'omnibus compilations, #7'
+    runs-on: ubuntu-latest
+    needs: compile-if
+    if: ${{ needs.compile-if.result == 'success' }}
+    timeout-minutes: 60
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with: { sparse-checkout-cone-mode: false, sparse-checkout: /.github, persist-credentials: false }
+      - { uses: './.github/actions/setup/directories', with: { srcdir: 'src', builddir: 'build', makeup: true, fetch-depth: 10 } }
+      - { uses: './.github/actions/compilers', name: 'disable-jit',         with: { append_configure: '--disable-yjit --disable-zjit' }, timeout-minutes: 5 }
+      - { uses: './.github/actions/compilers', name: 'disable-yjit',        with: { append_configure: '--disable-yjit' }, timeout-minutes: 5 }
+      - { uses: './.github/actions/compilers', name: 'disable-zjit',        with: { append_configure: '--disable-zjit' }, timeout-minutes: 5 }
+      - { uses: './.github/actions/compilers', name: 'disable-dln',         with: { append_configure: '--disable-dln' }, timeout-minutes: 5 }
+      - { uses: './.github/actions/compilers', name: 'enable-mkmf-verbose', with: { append_configure: '--enable-mkmf-verbose' }, timeout-minutes: 5 }
+      - { uses: './.github/actions/compilers', name: 'disable-rubygems',    with: { append_configure: '--disable-rubygems' }, timeout-minutes: 5 }
+      - { uses: './.github/actions/compilers', name: 'RUBY_DEVEL',          with: { append_configure: '--enable-devel' }, timeout-minutes: 5 }
+      - { uses: './.github/actions/compilers', name: 'OPT_THREADED_CODE=0',            with: { cppflags: '-DOPT_THREADED_CODE=0' }, timeout-minutes: 5 }
+
+  compile8:
+    name: 'omnibus compilations, #8'
+    runs-on: ubuntu-latest
+    needs: compile-if
+    if: ${{ needs.compile-if.result == 'success' }}
+    timeout-minutes: 60
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with: { sparse-checkout-cone-mode: false, sparse-checkout: /.github, persist-credentials: false }
+      - { uses: './.github/actions/setup/directories', with: { srcdir: 'src', builddir: 'build', makeup: true, fetch-depth: 10 } }
+      - { uses: './.github/actions/compilers', name: 'NDEBUG',                         with: { cppflags: '-DNDEBUG' }, timeout-minutes: 5 }
+      - { uses: './.github/actions/compilers', name: 'RUBY_DEBUG',                     with: { cppflags: '-DRUBY_DEBUG' }, timeout-minutes: 5 }
+      - { uses: './.github/actions/compilers', name: 'ARRAY_DEBUG',                    with: { cppflags: '-DARRAY_DEBUG' }, timeout-minutes: 5 }
+      - { uses: './.github/actions/compilers', name: 'CCAN_LIST_DEBUG',                with: { cppflags: '-DCCAN_LIST_DEBUG' }, timeout-minutes: 5 }
+      - { uses: './.github/actions/compilers', name: 'CPDEBUG=-1',                     with: { cppflags: '-DCPDEBUG=-1' }, timeout-minutes: 5 }
+      - { uses: './.github/actions/compilers', name: 'ENC_DEBUG',                      with: { cppflags: '-DENC_DEBUG' }, timeout-minutes: 5 }
+      - { uses: './.github/actions/compilers', name: 'GC_DEBUG',                       with: { cppflags: '-DGC_DEBUG' }, timeout-minutes: 5 }
+
+  compile9:
+    name: 'omnibus compilations, #9'
+    runs-on: ubuntu-latest
+    needs: compile-if
+    if: ${{ needs.compile-if.result == 'success' }}
+    timeout-minutes: 60
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with: { sparse-checkout-cone-mode: false, sparse-checkout: /.github, persist-credentials: false }
+      - { uses: './.github/actions/setup/directories', with: { srcdir: 'src', builddir: 'build', makeup: true, fetch-depth: 10 } }
+      - { uses: './.github/actions/compilers', name: 'HASH_DEBUG',                     with: { cppflags: '-DHASH_DEBUG' }, timeout-minutes: 5 }
+      - { uses: './.github/actions/compilers', name: 'ID_TABLE_DEBUG',                 with: { cppflags: '-DID_TABLE_DEBUG' }, timeout-minutes: 5 }
+      - { uses: './.github/actions/compilers', name: 'RGENGC_DEBUG=-1',                with: { cppflags: '-DRGENGC_DEBUG=-1' }, timeout-minutes: 5 }
+      - { uses: './.github/actions/compilers', name: 'SYMBOL_DEBUG',                   with: { cppflags: '-DSYMBOL_DEBUG' }, timeout-minutes: 5 }
+      - { uses: './.github/actions/compilers', name: 'RGENGC_CHECK_MODE',              with: { cppflags: '-DRGENGC_CHECK_MODE' }, timeout-minutes: 5 }
+      - { uses: './.github/actions/compilers', name: 'VM_CHECK_MODE',                  with: { cppflags: '-DVM_CHECK_MODE' }, timeout-minutes: 5 }
+      - { uses: './.github/actions/compilers', name: 'USE_EMBED_CI=0',                 with: { cppflags: '-DUSE_EMBED_CI=0' }, timeout-minutes: 5 }
+      - { uses: './.github/actions/compilers', name: 'USE_FLONUM=0',                   with: { cppflags: '-DUSE_FLONUM=0', append_configure: '--disable-yjit --disable-zjit' }, timeout-minutes: 5 }
+
+  compileX:
+    name: 'omnibus compilations, #10'
+    runs-on: ubuntu-latest
+    needs: compile-if
+    if: ${{ needs.compile-if.result == 'success' }}
+    timeout-minutes: 60
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with: { sparse-checkout-cone-mode: false, sparse-checkout: /.github, persist-credentials: false }
+      - { uses: './.github/actions/setup/directories', with: { srcdir: 'src', builddir: 'build', makeup: true, fetch-depth: 10 } }
+      - { uses: './.github/actions/compilers', name: 'USE_LAZY_LOAD',                  with: { cppflags: '-DUSE_LAZY_LOAD' }, timeout-minutes: 5 }
+      - { uses: './.github/actions/compilers', name: 'USE_RUBY_DEBUG_LOG=1',           with: { cppflags: '-DUSE_RUBY_DEBUG_LOG=1' }, timeout-minutes: 5 }
+      - { uses: './.github/actions/compilers', name: 'USE_DEBUG_COUNTER',              with: { cppflags: '-DUSE_DEBUG_COUNTER=1' }, timeout-minutes: 5 }
+      - { uses: './.github/actions/compilers', name: 'SHARABLE_MIDDLE_SUBSTRING',      with: { cppflags: '-DSHARABLE_MIDDLE_SUBSTRING=1' }, timeout-minutes: 5 }
+      - { uses: './.github/actions/compilers', name: 'DEBUG_FIND_TIME_NUMGUESS',       with: { cppflags: '-DDEBUG_FIND_TIME_NUMGUESS' }, timeout-minutes: 5 }
+      - { uses: './.github/actions/compilers', name: 'DEBUG_INTEGER_PACK',             with: { cppflags: '-DDEBUG_INTEGER_PACK' }, timeout-minutes: 5 }
+      - { uses: './.github/actions/compilers', name: 'OPT_THREADED_CODE=1',            with: { cppflags: '-DOPT_THREADED_CODE=1' }, timeout-minutes: 5 }
+      - { uses: './.github/actions/compilers', name: 'OPT_THREADED_CODE=2',            with: { cppflags: '-DOPT_THREADED_CODE=2' }, timeout-minutes: 5 }
+      - { uses: './.github/actions/compilers', name: 'clang 21', with: { tag: 'clang-21' }, timeout-minutes: 5 }
+
+  compileB:
+    name: 'omnibus compilations, #11'
+    runs-on: ubuntu-latest
+    needs: compile-if
+    if: ${{ needs.compile-if.result == 'success' }}
+    timeout-minutes: 60
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with: { sparse-checkout-cone-mode: false, sparse-checkout: /.github, persist-credentials: false }
+      - { uses: './.github/actions/setup/directories', with: { srcdir: 'src', builddir: 'build', makeup: true, fetch-depth: 10 } }
+      - { uses: './.github/actions/compilers', name: 'GC_DEBUG_STRESS_TO_CLASS',       with: { cppflags: '-DGC_DEBUG_STRESS_TO_CLASS' }, timeout-minutes: 5 }
+      - { uses: './.github/actions/compilers', name: 'GC_ENABLE_LAZY_SWEEP=0',         with: { cppflags: '-DGC_ENABLE_LAZY_SWEEP=0' }, timeout-minutes: 5 }
+      - { uses: './.github/actions/compilers', name: 'GC_PROFILE_DETAIL_MEMORY',       with: { cppflags: '-DGC_PROFILE_DETAIL_MEMORY' }, timeout-minutes: 5 }
+      - { uses: './.github/actions/compilers', name: 'GC_PROFILE_MORE_DETAIL',         with: { cppflags: '-DGC_PROFILE_MORE_DETAIL' }, timeout-minutes: 5 }
+      - { uses: './.github/actions/compilers', name: 'MALLOC_ALLOCATED_SIZE_CHECK',    with: { cppflags: '-DMALLOC_ALLOCATED_SIZE_CHECK' }, timeout-minutes: 5 }
+      - { uses: './.github/actions/compilers', name: 'RGENGC_ESTIMATE_OLDMALLOC',      with: { cppflags: '-DRGENGC_ESTIMATE_OLDMALLOC' }, timeout-minutes: 5 }
+      - { uses: './.github/actions/compilers', name: 'RGENGC_PROFILE',                 with: { cppflags: '-DRGENGC_PROFILE' }, timeout-minutes: 5 }
+
+  compileC:
+    name: 'omnibus compilations, #12'
+    runs-on: ubuntu-latest
+    needs: compile-if
+    if: ${{ needs.compile-if.result == 'success' }}
+    timeout-minutes: 60
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with: { sparse-checkout-cone-mode: false, sparse-checkout: /.github, persist-credentials: false }
+      - { uses: './.github/actions/setup/directories', with: { srcdir: 'src', builddir: 'build', makeup: true, fetch-depth: 10 } }
+      - { uses: './.github/actions/compilers', name: 'VM_DEBUG_BP_CHECK',              with: { cppflags: '-DVM_DEBUG_BP_CHECK' }, timeout-minutes: 5 }
+      - { uses: './.github/actions/compilers', name: 'VM_DEBUG_VERIFY_METHOD_CACHE',   with: { cppflags: '-DVM_DEBUG_VERIFY_METHOD_CACHE' }, timeout-minutes: 5 }
+      - { uses: './.github/actions/compilers', name: 'YJIT_FORCE_ENABLE',              with: { cppflags: '-DYJIT_FORCE_ENABLE' }, timeout-minutes: 5 }
+      - { uses: './.github/actions/compilers', name: 'UNIVERSAL_PARSER',               with: { cppflags: '-DUNIVERSAL_PARSER' }, timeout-minutes: 5 }
+      - { uses: './.github/actions/compilers', name: 'clang 23', with: { tag: 'clang-23' }, timeout-minutes: 5 }
+      - { uses: './.github/actions/compilers', name: 'clang 22', with: { tag: 'clang-22' }, timeout-minutes: 5 }
+      - { uses: './.github/actions/compilers', name: 'GCC 8',  with: { tag: 'gcc-8'  }, timeout-minutes: 5 }
+      - { uses: './.github/actions/compilers', name: 'GCC 7',  with: { tag: 'gcc-7'  }, timeout-minutes: 5 }
+
+  compilemax:
+    name: 'omnibus compilations, result'
+    runs-on: ubuntu-latest
+    if: ${{ always() }}
+    needs:
+      - 'compile1'
+      - 'compile2'
+      - 'compile3'
+      - 'compile4'
+      - 'compile5'
+      - 'compile6'
+      - 'compile7'
+      - 'compile8'
+      - 'compile9'
+      - 'compileX'
+      - 'compileB'
+      - 'compileC'
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with: { sparse-checkout-cone-mode: false, sparse-checkout: /.github, persist-credentials: false }
+      - uses: ./.github/actions/slack
+        with:
+          label: 'omnibus'
           SLACK_WEBHOOK_URL: ${{ secrets.SIMPLER_ALERTS_URL }} # ruby-lang slack: ruby/simpler-alerts-bot
-        if: failure() && github.event_name == 'push'
+        if: ${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') }}
+      - run: false
+        working-directory:
+        if: ${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') }}
+
+defaults:
+  run:
+    working-directory: build
diff --git a/.github/workflows/crosscompile.yml b/.github/workflows/crosscompile.yml
new file mode 100644
index 0000000000..4c28516e25
--- /dev/null
+++ b/.github/workflows/crosscompile.yml
@@ -0,0 +1,123 @@
+name: Cross compile
+on:
+  push:
+    paths-ignore:
+      - 'doc/**'
+      - '**/man/*'
+      - '**.md'
+      - '**.rdoc'
+      - '**/.document'
+      - '.*.yml'
+  pull_request:
+    # Do not use paths-ignore for required status checks
+    # https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/collaborating-on-repositories-with-code-quality-features/troubleshooting-required-status-checks
+  merge_group:
+
+concurrency:
+  group: ${{ github.workflow }} / ${{ startsWith(github.event_name, 'pull') && github.ref_name || github.sha }}
+  cancel-in-progress: ${{ startsWith(github.event_name, 'pull') }}
+
+permissions:
+  contents: read
+
+jobs:
+  make:
+    name: make (${{ matrix.host }} host on ${{ matrix.build }})
+    strategy:
+      matrix:
+        include:
+          - host: aarch64-linux-gnu
+            arch: arm64
+            build: x86_64-linux-gnu
+            runs-on: ubuntu-24.04
+            file_arch: ARM aarch64
+          - host: x86_64-linux-gnu
+            arch: amd64
+            build: aarch64-linux-gnu
+            runs-on: ubuntu-24.04-arm
+            file_arch: x86-64
+      fail-fast: false
+
+    env:
+      GITPULLOPTIONS: --no-tags origin ${{ github.ref }}
+
+    runs-on: ${{ matrix.runs-on }}
+
+    if: >-
+      ${{!(false
+      || contains(github.event.head_commit.message, '[DOC]')
+      || contains(github.event.pull_request.title, '[DOC]')
+      || contains(github.event.pull_request.labels.*.name, 'Documentation')
+      || (github.event.pull_request.user.login == 'dependabot[bot]')
+      )}}
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          sparse-checkout-cone-mode: false
+          sparse-checkout: /.github
+          persist-credentials: false
+
+      - uses: ./.github/actions/setup/directories
+        with:
+          srcdir: src
+          builddir: build
+          makeup: true
+
+      - name: Setup cross-compilation toolchain sources
+        run: |
+          native_arch=$(dpkg --print-architecture)
+          # Restrict existing sources to native arch
+          sudo sed -i '/^Architectures:/d' /etc/apt/sources.list.d/ubuntu.sources
+          sudo sed -i "/^Types:/a Architectures: ${native_arch}" /etc/apt/sources.list.d/ubuntu.sources
+          # Add cross-arch sources
+          if [ "${{ matrix.arch }}" = "arm64" ]; then
+            cross_uri="http://ports.ubuntu.com/"
+          else
+            cross_uri="http://archive.ubuntu.com/ubuntu/"
+          fi
+          printf '%s\n' \
+            "Types: deb" \
+            "URIs: ${cross_uri}" \
+            "Suites: noble noble-updates noble-security" \
+            "Components: main universe" \
+            "Architectures: ${{ matrix.arch }}" \
+            | sudo tee /etc/apt/sources.list.d/cross-${{ matrix.arch }}.sources
+
+      - uses: ./.github/actions/setup/ubuntu
+        with:
+          arch: ${{ matrix.arch }}
+
+      - uses: ./.github/actions/setup/baseruby
+        id: baseruby
+        with:
+          srcdir: src
+
+      - name: Run configure
+        run: >-
+          ../src/configure -C --disable-install-doc
+          --prefix=/usr
+          --build=${{ matrix.build }}
+          --host=${{ matrix.host }}
+          --with-baseruby="$baseruby"
+        env:
+          baseruby: ${{ steps.baseruby.outputs.ruby }}
+
+      - run: make
+
+      - run: make install DESTDIR=$PWD/install
+
+      - name: Verify cross-compiled binary
+        run: |
+          file install/usr/bin/ruby
+          file install/usr/bin/ruby | grep -q '${{ matrix.file_arch }}'
+
+      - uses: ./.github/actions/slack
+        with:
+          label: cross ${{ matrix.host }}
+          SLACK_WEBHOOK_URL: ${{ secrets.SIMPLER_ALERTS_URL }} # ruby-lang slack: ruby/simpler-alerts-bot
+        if: ${{ failure() }}
+
+defaults:
+  run:
+    working-directory: build
diff --git a/.github/workflows/cygwin.yml b/.github/workflows/cygwin.yml
new file mode 100644
index 0000000000..5ab86c7b19
--- /dev/null
+++ b/.github/workflows/cygwin.yml
@@ -0,0 +1,75 @@
+name: Cygwin
+on:
+  push:
+    paths-ignore:
+      - 'doc/**'
+      - '**/man/*'
+      - '**.md'
+      - '**.rdoc'
+      - '**/.document'
+      - '.*.yml'
+  pull_request:
+    paths-ignore:
+      - 'doc/**'
+      - '**/man/*'
+      - '**.md'
+      - '**.rdoc'
+      - '**/.document'
+      - '.*.yml'
+  merge_group:
+
+concurrency:
+  group: ${{ github.workflow }} / ${{ startsWith(github.event_name, 'pull') && github.ref_name || github.sha }}
+  cancel-in-progress: ${{ startsWith(github.event_name, 'pull') }}
+
+permissions:
+  contents: read
+
+jobs:
+  make:
+    runs-on: windows-2022
+
+    if: >-
+      ${{!(false
+      || contains(github.event.head_commit.message, '[DOC]')
+      || contains(github.event.pull_request.title, '[DOC]')
+      || contains(github.event.pull_request.labels.*.name, 'Documentation')
+      || (github.event.pull_request.user.login == 'dependabot[bot]')
+      )}}
+
+    steps:
+      - run: git config --global core.autocrlf input
+
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Setup Cygwin
+        uses: cygwin/cygwin-install-action@711d29f3da23c9f4a1798e369a6f01198c13b11a # v6.1
+        with:
+          packages: ruby gcc-core make autoconf libtool libssl-devel libyaml-devel libffi-devel zlib-devel rubygems
+          site: |
+            https://cygwin.osuosl.org/
+
+      - name: configure
+        run: |
+          ./autogen.sh
+          ./configure --disable-install-doc
+        shell: C:\cygwin\bin\bash.EXE --noprofile --norc -e -o igncr -o pipefail {0}
+
+      - name: Extract bundled gems
+        run: |
+          make ruby -j5
+          make extract-gems
+        shell: C:\cygwin\bin\bash.EXE --noprofile --norc -e -o igncr -o pipefail {0}
+
+      - name: make all
+        timeout-minutes: 30
+        run: make -j4 V=1
+        shell: C:\cygwin\bin\bash.EXE --noprofile --norc -e -o igncr -o pipefail {0}
+
+      - uses: ./.github/actions/slack
+        with:
+          label: Cygwin
+          SLACK_WEBHOOK_URL: ${{ secrets.SIMPLER_ALERTS_URL }} # ruby-lang slack: ruby/simpler-alerts-bot
+        if: ${{ failure() }}
diff --git a/.github/workflows/default_gems_list.yml b/.github/workflows/default_gems_list.yml
new file mode 100644
index 0000000000..f52b83103c
--- /dev/null
+++ b/.github/workflows/default_gems_list.yml
@@ -0,0 +1,99 @@
+name: Update default gems list
+on: [push, pull_request, merge_group]
+
+env:
+  UPDATE_NEWS_ENABLED: true
+
+concurrency:
+  group: ${{ github.workflow }} / ${{ startsWith(github.event_name, 'pull') && github.ref_name || github.sha }}
+  cancel-in-progress: ${{ startsWith(github.event_name, 'pull') }}
+
+permissions:
+  contents: read
+
+jobs:
+  update_default_gems_list:
+    name: Update default gems list
+
+    permissions:
+      contents: write # for Git to git push
+
+    runs-on: ubuntu-latest
+
+    if: ${{ github.repository == 'ruby/ruby' }}
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 # zizmor: ignore[artipacked]
+        with:
+          token: ${{ (github.repository == 'ruby/ruby' && !startsWith(github.event_name, 'pull')) && secrets.MATZBOT_AUTO_UPDATE_TOKEN || secrets.GITHUB_TOKEN }}
+
+      - id: gems
+        run: true
+        if: ${{ github.ref == 'refs/heads/master' }}
+
+      - uses: ./.github/actions/setup/directories
+        with:
+          makeup: true
+          # Skip overwriting MATZBOT_AUTO_UPDATE_TOKEN
+          checkout: '' # false (ref: https://github.com/actions/runner/issues/2238)
+        if: ${{ steps.gems.outcome == 'success' }}
+
+      - name: Download previous gems list
+        run: |
+          data=default_gems.json
+          mkdir -p .downloaded-cache
+          ln -s .downloaded-cache/$data .
+          curl --retry 5 --retry-connrefused --retry-delay 2 --retry-max-time 60 -O -R -z ./$data https://stdgems.org/$data
+        if: ${{ steps.gems.outcome == 'success' }}
+
+      - name: Make default gems list
+        run: |
+          #!ruby
+          require 'rubygems'
+          $:.unshift "lib"
+          rgver = File.foreach("lib/rubygems.rb") do |line|
+            break $1 if /^\s*VERSION\s*=\s*"([^"]+)"/ =~ line
+          end
+          gems = Dir.glob("{ext,lib}/**/*.gemspec").map do |f|
+            spec = Gem::Specification.load(f)
+            "#{spec.name} #{spec.version}"
+          end.sort
+          File.open("gems/default_gems", "w") do |f|
+            f.puts "RubyGems #{rgver}"
+            f.puts gems
+          end
+        shell: ruby --disable=gems {0}
+        if: ${{ steps.gems.outcome == 'success' }}
+
+      - name: Maintain updated gems list in NEWS
+        run: |
+          ruby tool/update-NEWS-gemlist.rb default
+        if: ${{ steps.gems.outcome == 'success' && env.UPDATE_NEWS_ENABLED == 'true' }}
+
+      - name: Check diffs
+        id: diff
+        run: |
+          git diff --color --no-ext-diff --ignore-submodules --exit-code NEWS.md ||
+          echo update=true >> $GITHUB_OUTPUT
+        if: ${{ steps.gems.outcome == 'success' }}
+
+      - name: Commit
+        run: |
+          git pull --ff-only origin ${GITHUB_REF#refs/heads/}
+          git commit --message="Update default gems list at ${GITHUB_SHA:0:30} [ci skip]" NEWS.md
+          git push origin ${GITHUB_REF#refs/heads/}
+        env:
+          EMAIL: svn-admin@ruby-lang.org
+          GIT_AUTHOR_NAME: git
+          GIT_COMMITTER_NAME: git
+        if: >-
+          ${{
+          github.repository == 'ruby/ruby' &&
+          !startsWith(github.event_name, 'pull') &&
+          steps.diff.outputs.update
+          }}
+
+      - uses: ./.github/actions/slack
+        with:
+          SLACK_WEBHOOK_URL: ${{ secrets.SIMPLER_ALERTS_URL }} # ruby-lang slack: ruby/simpler-alerts-bot
+        if: ${{ failure() }}
diff --git a/.github/workflows/dependabot_automerge.yml b/.github/workflows/dependabot_automerge.yml
new file mode 100644
index 0000000000..2e4dc8d7a2
--- /dev/null
+++ b/.github/workflows/dependabot_automerge.yml
@@ -0,0 +1,32 @@
+# from https://github.com/gofiber/swagger/blob/main/.github/workflows/dependabot_automerge.yml
+name: Dependabot auto-merge
+on:
+  pull_request:
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  automerge:
+    runs-on: ubuntu-latest
+    if: github.event.pull_request.user.login == 'dependabot[bot]' && github.repository == 'ruby/ruby'
+    steps:
+      - name: Dependabot metadata
+        uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0
+        id: metadata
+
+      - name: Wait for status checks
+        uses: lewagon/wait-on-check-action@9312864dfbc9fd208e9c0417843430751c042800 # v1.7.0
+        with:
+          repo-token: ${{ secrets.GITHUB_TOKEN }}
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          check-regexp: 'make \(check, .*\)'
+          wait-interval: 30
+
+      - name: Auto-merge for Dependabot PRs
+        if: ${{ steps.metadata.outputs.update-type == 'version-update:semver-minor' || steps.metadata.outputs.update-type == 'version-update:semver-patch' }}
+        run: gh pr merge --auto --rebase "$PR_URL"
+        env:
+          PR_URL: ${{ github.event.pull_request.html_url }}
+          GITHUB_TOKEN: ${{ secrets.MATZBOT_DEPENDABOT_MERGE_TOKEN }}
diff --git a/.github/workflows/labeler.yml b/.github/workflows/labeler.yml
new file mode 100644
index 0000000000..d0a8024b05
--- /dev/null
+++ b/.github/workflows/labeler.yml
@@ -0,0 +1,15 @@
+name: "Pull Request Labeler"
+on:
+- pull_request_target
+
+permissions:
+  contents: read
+
+jobs:
+  labeler:
+    permissions:
+      contents: read
+      pull-requests: write
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/labeler@f27b608878404679385c85cfa523b85ccb86e213 # v6.1.0
diff --git a/.github/workflows/macos.yml b/.github/workflows/macos.yml
index afd0c88aa4..501d35698b 100644
--- a/.github/workflows/macos.yml
+++ b/.github/workflows/macos.yml
@@ -1,66 +1,191 @@
 name: macOS
-on: [push, pull_request]
+on:
+  push:
+    paths-ignore:
+      - 'doc/**'
+      - '**/man/*'
+      - '**.md'
+      - '**.rdoc'
+      - '**/.document'
+      - '.*.yml'
+  pull_request:
+    # Do not use paths-ignore for required status checks
+    # https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/collaborating-on-repositories-with-code-quality-features/troubleshooting-required-status-checks#handling-skipped-but-required-checks
+  merge_group:
+
+concurrency:
+  group: ${{ github.workflow }} / ${{ startsWith(github.event_name, 'pull') && github.ref_name || github.sha }}
+  cancel-in-progress: ${{ startsWith(github.event_name, 'pull') }}
+
+permissions:
+  contents: read
+
 jobs:
   make:
-    runs-on: macos-latest
     strategy:
       matrix:
-        test_task: [ "check", "test-bundler-parallel", "test-bundled-gems", "leaked-globals" ]
+        include:
+          - test_task: check
+            os: macos-26
+          - test_task: check
+            os: macos-15
+            configure_args: '--with-gcc=gcc-14'
+          - test_task: check
+            os: macos-26
+            configure_args: '--with-jemalloc --with-opt-dir=$(brew --prefix jemalloc)'
+          - test_task: check
+            os: macos-26
+            configure_args: '--with-gmp'
+          - test_task: test-all
+            test_opts: --repeat-count=2
+            os: macos-26
+          - test_task: test-bundler-parallel
+            os: macos-26
+          - test_task: test-bundled-gems
+            os: macos-26
+          - test_task: check
+            os: macos-15
+          - test_task: check
+            os: macos-15-intel
+          - test_task: check
+            os: macos-14
       fail-fast: false
+
     env:
-      GITPULLOPTIONS: --no-tags origin ${{github.ref}}
-    if: "!contains(github.event.head_commit.message, '[ci skip]')"
+      GITPULLOPTIONS: --no-tags origin ${{ github.ref }}
+
+    runs-on: ${{ matrix.os }}
+
+    if: >-
+      ${{!(false
+      || contains(github.event.head_commit.message, '[DOC]')
+      || contains(github.event.pull_request.title, '[DOC]')
+      || contains(github.event.pull_request.labels.*.name, 'Documentation')
+      || (github.event.pull_request.user.login == 'dependabot[bot]')
+      )}}
+
     steps:
-      - name: Disable Firewall
-        run: |
-          sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setglobalstate off
-          sudo /usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate
-      - name: git config
-        run: |
-          git config --global advice.detachedHead 0
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
-          path: src
-      - run: ./src/tool/actions-commit-info.sh
-        id: commit_info
+          sparse-checkout-cone-mode: false
+          sparse-checkout: /.github
+          persist-credentials: false
+
       - name: Install libraries
+        uses: ./.github/actions/setup/macos
+
+      - uses: ./.github/actions/setup/directories
+        with:
+          srcdir: src
+          builddir: build
+          makeup: true
+          clean: true
+          dummy-files: ${{ matrix.test_task == 'check' }}
+          # Set fetch-depth: 0 so that Launchable can receive commits information.
+          fetch-depth: 10
+
+      - name: make sure that kern.coredump=1
         run: |
-          export WAITS='5 60'
-          tool/travis_retry.sh brew upgrade
-          tool/travis_retry.sh brew install gdbm gmp libffi openssl@1.1 zlib autoconf automake libtool readline
-        working-directory: src
-      - name: Set ENV
+          sysctl -n kern.coredump
+          sudo sysctl -w kern.coredump=1
+          sudo chmod -R +rwx /cores/
+
+      - name: Delete unused SDKs
+        # To free up disk space to not run out during the run
         run: |
-          echo '::set-env name=JOBS::'-j$((1 + $(sysctl -n hw.activecpu)))
-      - run: autoconf
-        working-directory: src
-      - run: mkdir build
+          sudo rm -rf ~/.dotnet
+          sudo rm -rf /Library/Android
+          sudo rm -rf /Library/Developer/CoreSimulator
+        continue-on-error: true
+
       - name: Run configure
-        run: ../src/configure -C --disable-install-doc --with-openssl-dir=$(brew --prefix openssl@1.1) --with-readline-dir=$(brew --prefix readline)
-        working-directory: build
-      - run: make $JOBS incs
-        working-directory: build
-      - run: make $JOBS
-        working-directory: build
+        run: ../src/configure -C --disable-install-doc ${ruby_configure_args} ${{ matrix.configure_args }}
+
       - run: make prepare-gems
-        working-directory: build
-        if: matrix.test_task == 'check'
-      - run: make $JOBS -s ${{ matrix.test_task }}
-        working-directory: build
+        if: ${{ matrix.test_task == 'test-bundled-gems' }}
+
+      - run: make
+
+      - run: make hello
+
+      - name: runirb
+        run: |
+          echo IRB::VERSION | make runirb RUNOPT="-- -f"
+
+      - name: Set test options for skipped tests
+        run: |
+          set -x
+          TESTS="$(echo "${{ matrix.skipped_tests }}" | sed 's| |$$/ -n!/|g;s|^|-n!/|;s|$|$$/|')"
+          echo "TESTS=${TESTS}" >> $GITHUB_ENV
+        if: ${{ matrix.test_task == 'check' && matrix.skipped_tests }}
+
+      - name: Set up Launchable
+        id: launchable
+        uses: ./.github/actions/launchable/setup
+        with:
+          os: ${{ matrix.os }}
+          test-opts: ${{ matrix.test_opts }}
+          launchable-token: ${{ secrets.LAUNCHABLE_TOKEN }}
+          builddir: build
+          srcdir: src
+        continue-on-error: true
+        timeout-minutes: 3
+
+      - name: Set extra test options
+        run: |
+          echo "TESTS=$TESTS ${{ matrix.test_opts }}" >> $GITHUB_ENV
+          echo "RUBY_TEST_TIMEOUT_SCALE=10" >> $GITHUB_ENV # With --repeat-count=2, flaky test by timeout occurs frequently for some reason
+        if: matrix.test_opts
+
+      - name: make ${{ matrix.test_task }}
+        run: |
+          test -n "${LAUNCHABLE_STDOUT}" && exec 1> >(tee "${LAUNCHABLE_STDOUT}")
+          test -n "${LAUNCHABLE_STDERR}" && exec 2> >(tee "${LAUNCHABLE_STDERR}")
+
+          ulimit -c unlimited
+          make -s ${{ matrix.test_task }} ${TESTS:+TESTS="$TESTS"}
+        timeout-minutes: 90
+        env:
+          RUBY_TESTOPTS: '-q --tty=no'
+          TEST_BUNDLED_GEMS_ALLOW_FAILURES: ''
+          PRECHECK_BUNDLED_GEMS: 'no'
+          LAUNCHABLE_STDOUT: ${{ steps.launchable.outputs.stdout_report_path }}
+          LAUNCHABLE_STDERR: ${{ steps.launchable.outputs.stderr_report_path }}
+
+      - name: make skipped tests
+        run: |
+          make -s test-all TESTS="${TESTS//-n!\//-n/}"
         env:
-          RUBY_TESTOPTS: "-q --tty=no"
-          # Remove minitest from TEST_BUNDLED_GEMS_ALLOW_FAILURES if https://github.com/seattlerb/minitest/pull/798 is resolved
-          TEST_BUNDLED_GEMS_ALLOW_FAILURES: "minitest,xmlrpc,rexml"
-      - uses: k0kubun/action-slack@v2.0.0
+          GNUMAKEFLAGS: ''
+          RUBY_TESTOPTS: '-v --tty=no'
+          PRECHECK_BUNDLED_GEMS: 'no'
+        if: ${{ matrix.test_task == 'check' && matrix.skipped_tests }}
+        continue-on-error: ${{ matrix.continue-on-skipped_tests || false }}
+
+      - name: CAPI extensions
+        uses: ./.github/actions/capiext
         with:
-          payload: |
-            {
-              "ci": "GitHub Actions",
-              "env": "${{ github.workflow }} / ${{ matrix.test_task }}",
-              "url": "https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}",
-              "commit": "${{ github.sha }}",
-              "branch": "${{ github.ref }}".split('/').reverse()[0]
-            }
+          builddir: build
         env:
+          RUBY_TESTOPTS: '-v --tty=no'
+        if: ${{ contains(matrix.extra_checks, 'capi') }}
+
+      - uses: ./.github/actions/slack
+        with:
+          label: ${{ matrix.os }} / ${{ matrix.test_task }}
           SLACK_WEBHOOK_URL: ${{ secrets.SIMPLER_ALERTS_URL }} # ruby-lang slack: ruby/simpler-alerts-bot
-        if: failure() && github.event_name == 'push'
+        if: ${{ failure() }}
+
+  result:
+    if: ${{ always() }}
+    name: ${{ github.workflow }} result
+    runs-on: ubuntu-latest
+    needs: [make]
+    steps:
+      - run: exit 1
+        working-directory:
+        if: ${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') }}
+
+defaults:
+  run:
+    working-directory: build
diff --git a/.github/workflows/mingw.yml b/.github/workflows/mingw.yml
index 95abd3300d..1efae8be59 100644
--- a/.github/workflows/mingw.yml
+++ b/.github/workflows/mingw.yml
@@ -1,144 +1,246 @@
 name: MinGW
-on: [push, pull_request]
+on:
+  push:
+    paths-ignore:
+      - 'doc/**'
+      - '**/man/*'
+      - '**.md'
+      - '**.rdoc'
+      - '**/.document'
+      - '.*.yml'
+  pull_request:
+    paths-ignore:
+      - 'doc/**'
+      - '**/man/*'
+      - '**.md'
+      - '**.rdoc'
+      - '**/.document'
+      - '.*.yml'
+  merge_group:
+
+concurrency:
+  group: ${{ github.workflow }} / ${{ startsWith(github.event_name, 'pull') && github.ref_name || github.sha }}
+  cancel-in-progress: ${{ startsWith(github.event_name, 'pull') }}
+
+permissions:
+  contents: read
 
 # Notes:
 # Actions console encoding causes issues, see test-all & test-spec steps
 #
 jobs:
   make:
-    runs-on: windows-2019
+    runs-on: windows-${{ matrix.os }}
+
+    name: ${{ github.workflow }} (${{ matrix.msystem }})
+
     env:
-      MSYSTEM: MINGW64
-      MSYSTEM_PREFIX: /mingw64
-      MSYS2_ARCH: x86_64
-      CHOST: "x86_64-w64-mingw32"
-      CFLAGS:   "-march=x86-64 -mtune=generic -O3 -pipe -fstack-protector-strong"
-      CXXFLAGS: "-march=x86-64 -mtune=generic -O3 -pipe"
-      CPPFLAGS: "-D_FORTIFY_SOURCE=2 -D__USE_MINGW_ANSI_STDIO=1 -DFD_SETSIZE=2048"
-      LDFLAGS:  "-pipe -fstack-protector-strong"
-      UPDATE_UNICODE: "UNICODE_FILES=. UNICODE_PROPERTY_FILES=. UNICODE_AUXILIARY_FILES=. UNICODE_EMOJI_FILES=."
-      GITPULLOPTIONS: --no-tags origin ${{github.ref}}
+      MSYSTEM: ${{ matrix.msystem }}
+      MSYS2_ARCH: >-
+        ${{ case(
+        contains(matrix.msystem, 'arm64'), 'aarch64',
+        contains(matrix.msystem, '64'), 'x86_64',
+        'i686'
+        ) }}
+      MINGW_PACKAGE_PREFIX: >-
+        mingw-w${{
+        case(endsWith(matrix.msystem, '64'), '64', '32')
+        }}-${{ case(
+        startsWith(matrix.msystem, 'clang'), 'clang',
+        startsWith(matrix.msystem, 'ucrt'), 'ucrt',
+        'mingw'
+        ) }}-${{ case(
+        contains(matrix.msystem, 'arm64'), 'aarch64',
+        endsWith(matrix.msystem, '64'), 'x86_64',
+        'i686'
+        ) }}
+      CFLAGS: '-mtune=generic -O3 -pipe'
+      CXXFLAGS: '-mtune=generic -O3 -pipe'
+      CPPFLAGS: '-D_FORTIFY_SOURCE=2 -D__USE_MINGW_ANSI_STDIO=1 -DFD_SETSIZE=2048'
+      LDFLAGS: '-pipe'
+      GITPULLOPTIONS: --no-tags origin ${{ github.ref }}
+
     strategy:
       matrix:
-        test_task: [ "check" ] # to make job names consistent
+        include:
+          # To mitigate flakiness of MinGW CI, we test only one runtime that newer MSYS2 uses.
+          # Ruby 3.2 is the first Windows Ruby to use OpenSSL 3.x
+          - msystem: 'UCRT64'
+            os: 2022
+            test_task: 'check'
+            test-all-opts: '--name=!/TestObjSpace#test_reachable_objects_during_iteration/'
+          - msystem: 'CLANGARM64'
+            os: 11-arm
+            test_task: 'check'
       fail-fast: false
-    if: "!contains(github.event.head_commit.message, '[ci skip]')"
+
+    if: >-
+      ${{!(false
+      || contains(github.event.head_commit.message, '[DOC]')
+      || contains(github.event.pull_request.title, '[DOC]')
+      || contains(github.event.pull_request.labels.*.name, 'Documentation')
+      || (github.event.pull_request.user.login == 'dependabot[bot]' && !startsWith(github.head_ref, 'dependabot/vcpkg'))
+      )}}
+
     steps:
-      - name: git config
-        run: |
-          git config --system core.autocrlf false
-          git config --system core.eol lf
-          git config --system advice.detachedHead 0
-      - uses: actions/checkout@v2
+      - uses: msys2/setup-msys2@e9898307ac31d1a803454791be09ab9973336e1c # v2.31.1
+        id: msys2
         with:
-          path: src
-      - run: ./src/tool/actions-commit-info.sh
-        shell: bash
-        id: commit_info
-      - name: Set up Ruby & MSYS2
-        uses: MSP-Greg/setup-ruby-pkgs@v1
-        with:
-          ruby-version: 2.6
-          mingw: _upgrade_ gdbm gmp libffi libyaml openssl ragel readline
-          msys2: automake1.16 bison
-      - name: where check
-        run: |
-          # show where
-          Write-Host
-          $where = 'gcc.exe', 'ragel.exe', 'make.exe', 'bison.exe', 'libcrypto-1_1-x64.dll', 'libssl-1_1-x64.dll'
-          foreach ($e in $where) {
-            $rslt = where.exe $e 2>&1 | Out-String
-            if ($rslt.contains($e)) { Write-Host $rslt }
-            else { Write-Host "`nCan't find $e" }
-          }
-      - name: misc setup, autoreconf
-        run: |
-          mkdir build
-          mkdir install
-          mkdir temp
-          cd src
-          sh -c "autoreconf -fi"
+          msystem: ${{ matrix.msystem }}
+          update: true
+          install: >-
+            git
+            make
+            ruby
+            autoconf
+            ${{ env.MINGW_PACKAGE_PREFIX }}-gcc
+            ${{ env.MINGW_PACKAGE_PREFIX }}-ragel
+            ${{ env.MINGW_PACKAGE_PREFIX }}-openssl
+            ${{ env.MINGW_PACKAGE_PREFIX }}-libyaml
+            ${{ env.MINGW_PACKAGE_PREFIX }}-libffi
 
-      - name: configure
-        working-directory: build
+      - name: Set up env
+        id: setup-env
+        working-directory:
         run: |
-          # Actions uses UTF8, causes test failures, similar to normal OS setup
-          $PSDefaultParameterValues['*:Encoding'] = 'utf8'
-          [Console]::OutputEncoding = [System.Text.Encoding]::GetEncoding("IBM437")
-          [Console]::InputEncoding  = [System.Text.Encoding]::GetEncoding("IBM437")
-          $config_args = "--build=$env:CHOST --host=$env:CHOST --target=$env:CHOST"
-          Write-Host $config_args
-          sh -c "../src/configure --disable-install-doc --prefix=/install $config_args"
-          # Write-Host "-------------------------------------- config.log"
-          # Get-Content ./config.log | foreach {Write-Output $_}
-
-      - name: update
-        working-directory: build
+          $msys2 = ${env:MSYS2_LOCATION}
+          $msystem = ${env:MSYSTEM}.ToLower()
+          echo $msys2\usr\bin $msys2\$msystem\bin |
+            Tee-Object ${env:GITHUB_PATH} -Append -Encoding utf-8
+
+          # Use the fast device for the temporary directory.
+          # %TEMP% is inconsistent with %TMP% and test-all expects they are consistent.
+          # https://github.com/actions/virtual-environments/issues/712#issuecomment-613004302
+          $tmp = ${env:RUNNER_TEMP}
+          echo HOME=$home TMP=$tmp TEMP=$tmp TMPDIR=$tmp |
+            Tee-Object ${env:GITHUB_ENV} -Append -Encoding utf-8
+        shell: pwsh             # cmd.exe does not strip spaces before `|`.
+        env:
+          MSYS2_LOCATION: ${{ steps.msys2.outputs.msys2-location }}
+          MSYSTEM: ${{ matrix.msystem }}
+
+      - name: Remove Strawberry Perl pkg-config
+        working-directory:
+        # `pkg-config.bat` included in Strawberry Perl is written in
+        # Perl and doesn't work when another msys2 `perl` precede its
+        # own `perl`.
+        #
+        # ```
+        # Can't find C:\Strawberry\perl\bin\pkg-config.bat on PATH, '.' not in PATH.
+        # ```
         run: |
-          $jobs = [int](2 * $env:NUMBER_OF_PROCESSORS)
-          make -j $jobs incs
+          Get-Command pkg-config.bat | % { ren $_.path ($_.path + "~") }
+        shell: pwsh
 
-      - name: download gems
-        working-directory: build
+      - name: Misc system & package info
+        working-directory:
         run: |
-          $jobs = [int](2 * $env:NUMBER_OF_PROCESSORS)
-          make -j $jobs update-gems
+          group() { echo ::group::$'\e[94;1m'"$*"$'\e[m'; }
+          endgroup() { echo ::endgroup::; }
+
+          group Path
+          cygpath -wa / . $(type -p cygpath bash sh)
+          endgroup
+
+          I() {
+              group $1
+              run Where type -pa $1 && { [ $# -eq 1 ] || run Version "$@"; } ||
+                  failed+=($1)
+              endgroup
+          }
+          run() { local w m=$1; shift; w="$("$@")" && show "$m" && indent "$w"; }
+          indent() { [ -z "$1" ] || echo "$1" | /bin/sed '/^$/!s/^/  /'; }
+          show() { echo $'\e[96m'"$*"$'\e[m'; }
+
+          failed=()
+
+          I gcc.exe --version
+          I ragel.exe --version
+          I make.exe --version
+          I openssl.exe version
+          I libcrypto-3-x64.dll
+          I libssl-3-x64.dll
+
+          group Packages
+          pacman -Qs $MINGW_PACKAGE_PREFIX-* | /bin/sed -n "s,local/$MINGW_PACKAGE_PREFIX-,,p"
+          endgroup
+
+          [ ${#failed[@]} -eq 0 ]
+        shell: sh
+
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          sparse-checkout-cone-mode: false
+          sparse-checkout: /.github
+          persist-credentials: false
+
+      - uses: ./.github/actions/setup/directories
+        with:
+          srcdir: src
+          builddir: build
+          makeup: true
+          # Set fetch-depth: 10 so that Launchable can receive commits information.
+          fetch-depth: 10
+
+      - name: configure
+        run: >
+          ../src/configure --disable-install-doc --prefix=/.
+          --build=$CHOST --host=$CHOST --target=$CHOST
+        shell: sh
+        env:
+          CHOST: ${{ env.MSYS2_ARCH }}-w64-mingw32
 
       - name: make all
-        timeout-minutes: 40
-        working-directory: build
-        run: |
-          $jobs = [int](2 * $env:NUMBER_OF_PROCESSORS)
-          make -j $jobs
+        timeout-minutes: 30
+        run: make -j4
 
       - name: make install
-        working-directory: build
-        run: |
-          # Actions uses UTF8, causes test failures, similar to normal OS setup
-          $PSDefaultParameterValues['*:Encoding'] = 'utf8'
-          [Console]::OutputEncoding = [System.Text.Encoding]::GetEncoding("IBM437")
-          [Console]::InputEncoding  = [System.Text.Encoding]::GetEncoding("IBM437")
-          make DESTDIR=.. install-nodoc
+        run: make DESTDIR=../install install-nodoc
+
+      - name: Set up Launchable
+        uses: ./.github/actions/launchable/setup
+        with:
+          os: windows-2022
+          launchable-token: ${{ secrets.LAUNCHABLE_TOKEN }}
+          builddir: build
+          srcdir: src
+          test-tasks: '["test", "test-all", "test-spec"]'
+        continue-on-error: true
+        timeout-minutes: 3
 
       - name: test
-        timeout-minutes: 5
-        working-directory: build
-        run: |
-          make test
+        timeout-minutes: 30
+        run: make test test-tool
+        env:
+          GNUMAKEFLAGS: ''
+          RUBY_TESTOPTS: '-v --tty=no'
+        if: ${{ matrix.test_task == 'check' || matrix.test_task == 'test' }}
 
       - name: test-all
-        timeout-minutes: 50
-        working-directory: build
+        timeout-minutes: 45
         run: |
-          # Actions uses UTF8, causes test failures, similar to normal OS setup
-          $PSDefaultParameterValues['*:Encoding'] = 'utf8'
-          [Console]::OutputEncoding = [System.Text.Encoding]::GetEncoding("IBM437")
-          [Console]::InputEncoding  = [System.Text.Encoding]::GetEncoding("IBM437")
-          $jobs = [int](1.5 * $env:NUMBER_OF_PROCESSORS)
-          make test-all TESTOPTS="-j $jobs --retry --job-status=normal --show-skip --timeout-scale=1.5"
+          make ${{ StartsWith(matrix.test_task, 'test/') && matrix.test_task || 'test-all' }}
+        env:
+          RUBY_TESTOPTS: >-
+            --retry --job-status=normal --show-skip --timeout-scale=1.5 -j4
+            ${{ matrix.test-all-opts }}
+            ${{ env.TESTS }}
+          BUNDLER_VERSION:
+        if: ${{ matrix.test_task == 'check' || matrix.test_task == 'test-all' || StartsWith(matrix.test_task, 'test/') }}
 
       - name: test-spec
         timeout-minutes: 10
-        working-directory: src/spec/ruby
         run: |
-          $env:Path = "$pwd/../../../install/bin;$env:Path"
-          # Actions uses UTF8, causes test failures, similar to normal OS setup
-          $PSDefaultParameterValues['*:Encoding'] = 'utf8'
-          [Console]::OutputEncoding = [System.Text.Encoding]::GetEncoding("IBM437")
-          [Console]::InputEncoding  = [System.Text.Encoding]::GetEncoding("IBM437")
-          ruby -v
-          ruby ../mspec/bin/mspec -j
-
-      - uses: k0kubun/action-slack@v2.0.0
+          make ${{ StartsWith(matrix.test_task, 'spec/') && matrix.test_task || 'test-spec' }}
+        if: ${{ matrix.test_task == 'check' || matrix.test_task == 'test-spec' || StartsWith(matrix.test_task, 'spec/') }}
+
+      - uses: ./src/.github/actions/slack
         with:
-          payload: |
-            {
-              "ci": "GitHub Actions",
-              "env": "${{ github.workflow }} / ${{ matrix.test_task }}",
-              "url": "https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}",
-              "commit": "${{ github.sha }}",
-              "branch": "${{ github.ref }}".split('/').reverse()[0]
-            }
-        env:
+          label: ${{ matrix.msystem }} / ${{ matrix.test_task }}
           SLACK_WEBHOOK_URL: ${{ secrets.SIMPLER_ALERTS_URL }} # ruby-lang slack: ruby/simpler-alerts-bot
-        if: failure() && github.event_name == 'push'
+        if: ${{ failure() }}
+
+defaults:
+  run:
+    working-directory: build
+    shell: cmd
diff --git a/.github/workflows/mjit.yml b/.github/workflows/mjit.yml
deleted file mode 100644
index 05d944b766..0000000000
--- a/.github/workflows/mjit.yml
+++ /dev/null
@@ -1,68 +0,0 @@
-name: MJIT
-on: [push, pull_request]
-jobs:
-  make:
-    strategy:
-      matrix:
-        test_task: [ "check" ] # to make job names consistent
-        jit_opts: [ "--jit", "--jit-wait" ]
-      fail-fast: false
-    runs-on: ubuntu-latest
-    if: "!contains(github.event.head_commit.message, '[ci skip]')"
-    env:
-      TESTOPTS: '-q --tty=no'
-      RUN_OPTS: '--disable-gems --jit-warnings ${{ matrix.jit_opts }}'
-      GITPULLOPTIONS: --no-tags origin ${{github.ref}}
-    steps:
-      - name: Install libraries
-        run: |
-          set -x
-          sudo apt-get update -q || :
-          sudo apt-get install --no-install-recommends -q -y build-essential libssl-dev libyaml-dev libreadline6-dev zlib1g-dev libncurses5-dev libffi-dev libgdbm-dev bison autoconf ruby
-      - name: git config
-        run: |
-          git config --global advice.detachedHead 0
-      - uses: actions/checkout@v2
-        with:
-          path: src
-      - run: ./src/tool/actions-commit-info.sh
-        id: commit_info
-      - name: Fixed world writable dirs
-        run: |
-          chmod -v go-w $HOME $HOME/.config
-          sudo chmod -R go-w /usr/share
-          sudo bash -c 'IFS=:; for d in '"$PATH"'; do chmod -v go-w $d; done' || :
-      - name: Set ENV
-        run: |
-          echo '::set-env name=JOBS::'-j$((1 + $(nproc --all)))
-      - run: autoconf
-        working-directory: src
-      - run: mkdir build
-      - name: Run configure
-        run: ../src/configure -C --disable-install-doc
-        working-directory: build
-      - run: make $JOBS incs
-        working-directory: build
-      - run: make $JOBS
-        working-directory: build
-      - run: sudo make $JOBS -s install
-        working-directory: build
-      - run: make $JOBS -s test
-        working-directory: build
-      - run: make $JOBS -s test-all
-        working-directory: build
-      - run: make $JOBS -s test-spec
-        working-directory: build
-      - uses: k0kubun/action-slack@v2.0.0
-        with:
-          payload: |
-            {
-              "ci": "GitHub Actions",
-              "env": "${{ github.workflow }} / ${{ matrix.test_task }} ${{ matrix.jit_opts }}",
-              "url": "https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}",
-              "commit": "${{ github.sha }}",
-              "branch": "${{ github.ref }}".split('/').reverse()[0]
-            }
-        env:
-          SLACK_WEBHOOK_URL: ${{ secrets.SIMPLER_ALERTS_URL }} # ruby-lang slack: ruby/simpler-alerts-bot
-        if: failure() && github.event_name == 'push'
diff --git a/.github/workflows/modgc.yml b/.github/workflows/modgc.yml
new file mode 100644
index 0000000000..bd3c6ab575
--- /dev/null
+++ b/.github/workflows/modgc.yml
@@ -0,0 +1,179 @@
+name: ModGC
+on:
+  push:
+    paths-ignore:
+      - 'doc/**'
+      - '**/man/*'
+      - '**.md'
+      - '**.rdoc'
+      - '**/.document'
+      - '.*.yml'
+  pull_request:
+    # Do not use paths-ignore for required status checks
+    # https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/collaborating-on-repositories-with-code-quality-features/troubleshooting-required-status-checks#handling-skipped-but-required-checks
+  merge_group:
+
+concurrency:
+  group: ${{ github.workflow }} / ${{ startsWith(github.event_name, 'pull') && github.ref_name || github.sha }}
+  cancel-in-progress: ${{ startsWith(github.event_name, 'pull') }}
+
+permissions:
+  contents: read
+
+jobs:
+  check:
+    strategy:
+      matrix:
+        gc:
+          - name: default
+          - name: mmtk
+            mmtk_build: release
+        os: [macos-26, ubuntu-latest]
+        include:
+          - test_task: check
+      fail-fast: false
+
+    env:
+      GITPULLOPTIONS: --no-tags origin ${{ github.ref }}
+      RUBY_DEBUG: ci
+
+    runs-on: ${{ matrix.os }}
+
+    if: >-
+      ${{!(false
+      || contains(github.event.head_commit.message, '[DOC]')
+      || contains(github.event.pull_request.title, '[DOC]')
+      || contains(github.event.pull_request.labels.*.name, 'Documentation')
+      || (github.event.pull_request.user.login == 'dependabot[bot]')
+      )}}
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          sparse-checkout-cone-mode: false
+          sparse-checkout: /.github
+          persist-credentials: false
+
+      - name: Install libraries (macOS)
+        uses: ./.github/actions/setup/macos
+        if: ${{ contains(matrix.os, 'macos') }}
+
+      - name: Install libraries (Ubuntu)
+        uses: ./.github/actions/setup/ubuntu
+        if: ${{ contains(matrix.os, 'ubuntu') }}
+
+      - uses: ruby/setup-ruby@afeafc3d1ab54a631816aba4c914a0081c12ff2f # v1.310.0
+        with:
+          ruby-version: '3.1'
+          bundler: none
+        if: ${{ contains(matrix.os, 'ubuntu') }}
+
+      - uses: ./.github/actions/setup/directories
+        with:
+          srcdir: src
+          builddir: build
+          makeup: true
+          clean: true
+          dummy-files: false
+          # Set fetch-depth: 10 so that Launchable can receive commits information.
+          fetch-depth: 10
+
+      - name: make sure that kern.coredump=1
+        run: |
+          sysctl -n kern.coredump
+          sudo sysctl -w kern.coredump=1
+          sudo chmod -R +rwx /cores/
+        if: ${{ contains(matrix.os, 'macos') }}
+
+      - name: Delete unused SDKs
+        # To free up disk space to not run out during the run
+        run: |
+          sudo rm -rf ~/.dotnet
+          sudo rm -rf /Library/Android
+          sudo rm -rf /Library/Developer/CoreSimulator
+        continue-on-error: true
+        if: ${{ contains(matrix.os, 'macos') }}
+
+      - name: Setup Ruby GC Directory
+        run: |
+          echo "MODULAR_GC_DIR=$HOME/ruby_gc" >> $GITHUB_ENV
+
+      - name: Run configure
+        env:
+          arch: ${{ matrix.arch }}
+        run: |
+          ${SETARCH} ../src/configure -C --disable-install-doc --with-modular-gc="${MODULAR_GC_DIR}" \
+          ${arch:+--target=$arch-$OSTYPE --host=$arch-$OSTYPE}
+
+      - uses: actions-rust-lang/setup-rust-toolchain@46268bd060767258de96ed93c1251119784f2ab6 # v1.16.1
+        with:
+          cache-bin: false
+      - name: Set MMTk environment variables
+        run: |
+          echo 'EXCLUDES=../src/test/.excludes-mmtk' >> $GITHUB_ENV
+          echo 'MSPECOPT=-B../src/spec/mmtk.mspec' >> $GITHUB_ENV
+        if: ${{ matrix.gc.name == 'mmtk' }}
+
+      - run: ${SETARCH} make
+
+      - name: Build Modular  GC
+        run: |
+          echo "RUBY_GC_LIBRARY=${{ matrix.gc.name }}" >> $GITHUB_ENV
+          make install-modular-gc MODULAR_GC=${{ matrix.gc.name }} MMTK_BUILD=${{ matrix.gc.mmtk_build }}
+          make distclean-modular-gc MODULAR_GC=${{ matrix.gc.name }}
+
+      - run: ${SETARCH} make hello
+
+      - name: Set test options for skipped tests
+        run: |
+          set -x
+          TESTS="$(echo "${{ matrix.skipped_tests }}" | sed 's| |$$/ -n!/|g;s|^|-n!/|;s|$|$$/|')"
+          echo "TESTS=${TESTS}" >> $GITHUB_ENV
+        if: ${{ matrix.test_task == 'check' && matrix.skipped_tests }}
+
+      - name: Set up Launchable
+        id: launchable
+        uses: ./.github/actions/launchable/setup
+        with:
+          os: ${{ matrix.os || 'ubuntu-22.04' }}
+          test-opts: ${{ matrix.configure }}
+          launchable-token: ${{ secrets.LAUNCHABLE_TOKEN }}
+          builddir: build
+          srcdir: src
+        continue-on-error: true
+        timeout-minutes: 3
+
+      - name: make ${{ matrix.test_task }}
+        run: |
+          test -n "${LAUNCHABLE_STDOUT}" && exec 1> >(tee "${LAUNCHABLE_STDOUT}")
+          test -n "${LAUNCHABLE_STDERR}" && exec 2> >(tee "${LAUNCHABLE_STDERR}")
+
+          ${SETARCH} make -s ${{ matrix.test_task }} \
+            ${TESTS:+TESTS="$TESTS"} \
+            ${{ !contains(matrix.test_task, 'bundle') && 'RUBYOPT=-w' || '' }}
+        timeout-minutes: ${{ matrix.gc.timeout || 40 }}
+        env:
+          RUBY_TESTOPTS: '-q --tty=no'
+          TEST_BUNDLED_GEMS_ALLOW_FAILURES: ''
+          PRECHECK_BUNDLED_GEMS: 'no'
+          LAUNCHABLE_STDOUT: ${{ steps.launchable.outputs.stdout_report_path }}
+          LAUNCHABLE_STDERR: ${{ steps.launchable.outputs.stderr_report_path }}
+
+      - name: make skipped tests
+        run: |
+          ${SETARCH} make -s test-all TESTS="${TESTS//-n!\//-n/}"
+        env:
+          GNUMAKEFLAGS: ''
+          RUBY_TESTOPTS: '-v --tty=no'
+        if: ${{ matrix.test_task == 'check' && matrix.skipped_tests }}
+        continue-on-error: ${{ matrix.continue-on-skipped_tests || false }}
+
+      - uses: ./.github/actions/slack
+        with:
+          label: ${{ matrix.test_task }} ${{ matrix.configure }}${{ matrix.arch }}
+          SLACK_WEBHOOK_URL: ${{ secrets.SIMPLER_ALERTS_URL }} # ruby-lang slack: ruby/simpler-alerts-bot
+        if: ${{ failure() }}
+
+defaults:
+  run:
+    working-directory: build
diff --git a/.github/workflows/parse_y.yml b/.github/workflows/parse_y.yml
new file mode 100644
index 0000000000..a0082f71de
--- /dev/null
+++ b/.github/workflows/parse_y.yml
@@ -0,0 +1,101 @@
+name: parse.y
+on:
+  push:
+    paths-ignore:
+      - 'doc/**'
+      - '**/man/*'
+      - '**.md'
+      - '**.rdoc'
+      - '**/.document'
+      - '.*.yml'
+  pull_request:
+    paths-ignore:
+      - 'doc/**'
+      - '**/man/*'
+      - '**.md'
+      - '**.rdoc'
+      - '**/.document'
+      - '.*.yml'
+  merge_group:
+
+concurrency:
+  group: ${{ github.workflow }} / ${{ startsWith(github.event_name, 'pull') && github.ref_name || github.sha }}
+  cancel-in-progress: ${{ startsWith(github.event_name, 'pull') }}
+
+permissions:
+  contents: read
+
+jobs:
+  make:
+    strategy:
+      matrix:
+        include:
+          - test_task: check
+          - test_task: test-bundler-parallel
+          - test_task: test-bundled-gems
+      fail-fast: false
+
+    env:
+      GITPULLOPTIONS: --no-tags origin ${{ github.ref }}
+      RUBY_DEBUG: ci
+      SETARCH: ${{ matrix.arch && format('setarch {0}', matrix.arch) }}
+
+    runs-on: ubuntu-22.04
+
+    if: >-
+      ${{!(false
+      || contains(github.event.head_commit.message, '[DOC]')
+      || contains(github.event.pull_request.title, '[DOC]')
+      || contains(github.event.pull_request.labels.*.name, 'Documentation')
+      || (github.event.pull_request.user.login == 'dependabot[bot]')
+      )}}
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          sparse-checkout-cone-mode: false
+          sparse-checkout: /.github
+          persist-credentials: false
+
+      - uses: ./.github/actions/setup/ubuntu
+
+      - uses: ruby/setup-ruby@afeafc3d1ab54a631816aba4c914a0081c12ff2f # v1.310.0
+        with:
+          ruby-version: '3.1'
+          bundler: none
+
+      - uses: ./.github/actions/setup/directories
+        with:
+          srcdir: src
+          builddir: build
+          makeup: true
+          clean: true
+          dummy-files: ${{ matrix.test_task == 'check' }}
+
+      - name: Run configure
+        run: ../src/configure -C --disable-install-doc cppflags=-DRUBY_DEBUG --with-parser=parse.y
+
+      - run: make
+
+      - run: make TESTRUN_SCRIPT='-renvutil -v -e "exit EnvUtil.current_parser == %[parse.y]"' run
+        env:
+          RUNOPT0: -I$(tooldir)/lib
+
+      - name: make ${{ matrix.test_task }}
+        run: make -s ${{ matrix.test_task }} RUN_OPTS="$RUN_OPTS" SPECOPTS="$SPECOPTS"
+        env:
+          RUBY_TESTOPTS: ${{ matrix.testopts }}
+          EXCLUDES: '../src/test/.excludes-parsey'
+          RUN_OPTS: ${{ matrix.run_opts || '--parser=parse.y' }}
+          SPECOPTS: ${{ matrix.specopts || '-T --parser=parse.y' }}
+          TEST_BUNDLED_GEMS_ALLOW_FAILURES: ''
+
+      - uses: ./.github/actions/slack
+        with:
+          label: ${{ matrix.run_opts }}
+          SLACK_WEBHOOK_URL: ${{ secrets.SIMPLER_ALERTS_URL }} # ruby-lang slack: ruby/simpler-alerts-bot
+        if: ${{ failure() }}
+
+defaults:
+  run:
+    working-directory: build
diff --git a/.github/workflows/post_push.yml b/.github/workflows/post_push.yml
new file mode 100644
index 0000000000..237679ebb1
--- /dev/null
+++ b/.github/workflows/post_push.yml
@@ -0,0 +1,97 @@
+name: Post-push
+on:
+  push:
+    branches:
+      - master
+      - 'ruby_*_*'
+
+permissions:
+  contents: read
+
+jobs:
+  hooks:
+    name: Post-push hooks
+    runs-on: ubuntu-latest
+    if: ${{ github.repository == 'ruby/ruby' }}
+    steps:
+      - name: Sync git.ruby-lang.org
+        id: sync-git
+        continue-on-error: true
+        run: |
+          mkdir -p ~/.ssh
+          (umask 066; printenv RUBY_GIT_SYNC_PRIVATE_KEY > ~/.ssh/id_ed25519)
+          ssh-keyscan -t ed25519 git.ruby-lang.org >> ~/.ssh/known_hosts
+          ssh -i ~/.ssh/id_ed25519 git-sync@git.ruby-lang.org "sudo -u git /home/git/git.ruby-lang.org/bin/update-ruby.sh $GITHUB_REF"
+        env:
+          GITHUB_REF: ${{ github.ref }}
+          RUBY_GIT_SYNC_PRIVATE_KEY: ${{ secrets.RUBY_GIT_SYNC_PRIVATE_KEY }}
+        if: ${{ github.ref == 'refs/heads/master' || startsWith(github.ref, 'refs/heads/ruby_') }}
+
+      - name: Fetch changesets on bugs.ruby-lang.org
+        run: |
+          curl "https://bugs.ruby-lang.org/sys/fetch_changesets?key=${REDMINE_SYS_API_KEY}" -s --fail-with-body -w '* status: %{http_code}\n'
+        env:
+          REDMINE_SYS_API_KEY: ${{ secrets.REDMINE_SYS_API_KEY }}
+        if: ${{ github.ref == 'refs/heads/master' || startsWith(github.ref, 'refs/heads/ruby_') }}
+
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 # zizmor: ignore[artipacked]
+        with:
+          fetch-depth: 500 # for notify-slack-commits
+          token: ${{ secrets.MATZBOT_AUTO_UPDATE_TOKEN }}
+
+      - name: Notify commit to Slack
+        run: ruby tool/notify-slack-commits.rb "$GITHUB_OLD_SHA" "$GITHUB_NEW_SHA" refs/heads/master
+        env:
+          GITHUB_OLD_SHA: ${{ github.event.before }}
+          GITHUB_NEW_SHA: ${{ github.event.after }}
+          SLACK_WEBHOOK_URL_ALERTS: ${{ secrets.SLACK_WEBHOOK_URL_ALERTS }}
+          SLACK_WEBHOOK_URL_COMMITS: ${{ secrets.SLACK_WEBHOOK_URL_COMMITS }}
+          SLACK_WEBHOOK_URL_RUBY_JP: ${{ secrets.SLACK_WEBHOOK_URL_RUBY_JP }}
+        if: ${{ github.ref == 'refs/heads/master' }}
+
+      - name: Notify commit to ruby-cvs
+        run: |
+          SENDMAIL="ssh -i ${HOME}/.ssh/id_ed25519 git-sync@git.ruby-lang.org /usr/sbin/sendmail" \
+            ruby tool/commit-email.rb . ruby-cvs@g.ruby-lang.org \
+            "$GITHUB_OLD_SHA" "$GITHUB_NEW_SHA" "$GITHUB_REF" \
+            --viewer-uri "https://github.com/ruby/ruby/commit/" \
+            --error-to cvs-admin@ruby-lang.org
+        env:
+          GITHUB_OLD_SHA: ${{ github.event.before }}
+          GITHUB_NEW_SHA: ${{ github.event.after }}
+          GITHUB_REF: ${{ github.ref }}
+        if: ${{ github.ref == 'refs/heads/master' || startsWith(github.ref, 'refs/heads/ruby_') }}
+
+      - name: Auto-correct code styles
+        run: |
+          set -x
+          ruby tool/auto-style.rb "$GITHUB_OLD_SHA" "$GITHUB_NEW_SHA" refs/heads/master
+        env:
+          GITHUB_OLD_SHA: ${{ github.event.before }}
+          GITHUB_NEW_SHA: ${{ github.event.after }}
+          GIT_AUTHOR_NAME: git
+          GIT_COMMITTER_NAME: git
+          EMAIL: svn-admin@ruby-lang.org
+        if: ${{ github.ref == 'refs/heads/master' }}
+
+      - name: Push PR notes to GitHub
+        id: pr-notes
+        continue-on-error: true
+        run: ruby tool/notes-github-pr.rb "$(pwd)/.git" "$GITHUB_OLD_SHA" "$GITHUB_NEW_SHA" refs/heads/master
+        env:
+          GITHUB_OLD_SHA: ${{ github.event.before }}
+          GITHUB_NEW_SHA: ${{ github.event.after }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GIT_AUTHOR_NAME: git
+          GIT_COMMITTER_NAME: git
+          EMAIL: svn-admin@ruby-lang.org
+        if: ${{ github.ref == 'refs/heads/master' }}
+
+      - name: Check for failures
+        run: exit 1
+        if: ${{ steps.sync-git.outcome == 'failure' || steps.pr-notes.outcome == 'failure' }}
+
+      - uses: ./.github/actions/slack
+        with:
+          SLACK_WEBHOOK_URL: ${{ secrets.SIMPLER_ALERTS_URL }} # ruby-lang slack: ruby/simpler-alerts-bot
+        if: ${{ failure() }}
diff --git a/.github/workflows/pr-playground.yml b/.github/workflows/pr-playground.yml
new file mode 100644
index 0000000000..dc4f075a38
--- /dev/null
+++ b/.github/workflows/pr-playground.yml
@@ -0,0 +1,131 @@
+name: Post Playground link to PR
+on:
+  pull_request_target:
+    types: [labeled]
+  workflow_run:
+    workflows: ["WebAssembly"]
+    types: [completed]
+
+permissions:
+  contents: read
+  actions: read
+
+jobs:
+  post-summary:
+    name: Post Playground link
+    runs-on: ubuntu-latest
+    permissions:
+      pull-requests: write
+    # Post a comment only if the PR status check is passed and the PR is labeled with `Playground`.
+    # Triggered twice: when the PR is labeled and when PR build is passed.
+    if: >-
+      ${{ false
+      || (true
+        && github.event_name == 'pull_request_target'
+        && contains(github.event.pull_request.labels.*.name, 'Playground'))
+      || (true
+        && github.event_name == 'workflow_run'
+        && github.event.workflow_run.conclusion == 'success'
+        && github.event.workflow_run.event == 'pull_request')
+      }}
+    steps:
+      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            const fs = require('fs/promises');
+
+            const buildWorkflowPath = '.github/workflows/wasm.yml';
+            const findSuccessfuBuildRun = async (pr) => {
+              const opts = github.rest.actions.listWorkflowRunsForRepo.endpoint.merge({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                status: 'success',
+                branch: pr.head.ref,
+              });
+              const runs = await github.paginate(opts);
+              const buildRun = runs.find(run => run.path == buildWorkflowPath);
+              return buildRun;
+            }
+
+            const postComment = async (body, pr) => {
+              const { data: comments } = await github.rest.issues.listComments({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: pr.number,
+              });
+
+              const commentOpts = { owner: context.repo.owner, repo: context.repo.repo, body: comment };
+
+              const existingComment = comments.find(comment => comment.body.startsWith(magicComment));
+              if (existingComment) {
+                core.info(`Updating existing comment: ${existingComment.html_url}`);
+                await github.rest.issues.updateComment({
+                  ...commentOpts, comment_id: existingComment.id
+                });
+              } else {
+                await github.rest.issues.createComment({
+                  ...commentOpts, issue_number: pr.number
+                });
+              }
+            }
+
+            const derivePRNumber = async () => {
+              if (context.payload.pull_request) {
+                return context.payload.pull_request.number;
+              }
+              // Workaround for https://github.com/orgs/community/discussions/25220
+
+              const { data: { artifacts } } = await github.rest.actions.listWorkflowRunArtifacts({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                run_id: context.payload.workflow_run.id,
+              });
+              const artifact = artifacts.find(artifact => artifact.name == 'github-pr-info');
+              if (!artifact) {
+                throw new Error('Cannot find github-pr-info.txt artifact');
+              }
+
+              const { data } = await github.rest.actions.downloadArtifact({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                artifact_id: artifact.id,
+                archive_format: 'zip',
+              });
+
+              await fs.writeFile('pr-info.zip', Buffer.from(data));
+              await exec.exec('unzip', ['pr-info.zip']);
+              return await fs.readFile('github-pr-info.txt', 'utf8');
+            }
+
+            const prNumber = await derivePRNumber();
+
+            const { data: pr } = await github.rest.pulls.get({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              pull_number: prNumber,
+            });
+
+            core.info(`Checking if the PR ${prNumber} is labeled with Playground...`);
+            if (!pr.labels.some(label => label.name == 'Playground')) {
+              core.info(`The PR is not labeled with Playground.`);
+              return;
+            }
+
+            core.info(`Checking if the build is successful for ${pr.head.ref} in ${pr.head.repo.owner.login}/${pr.head.repo.name}...`);
+            const buildRun = await findSuccessfuBuildRun(pr);
+            if (!buildRun) {
+              core.info(`No successful build run found for ${buildWorkflowPath} on ${pr.head.ref} yet.`);
+              return;
+            }
+            core.info(`Found a successful build run: ${buildRun.html_url}`);
+
+            const runLink = `${process.env.GITHUB_SERVER_URL}/${process.env.GITHUB_REPOSITORY}/actions/runs/${process.env.GITHUB_RUN_ID}`;
+            const magicComment = `<!-- AUTO-GENERATED-COMMENT-PR-PLAYGROUND -->`;
+            const comment = `${magicComment}
+            **Try on Playground**: https://ruby.github.io/play-ruby?run=${buildRun.id}
+            This is an automated comment by [\`pr-playground.yml\`](${runLink}) workflow.
+            `;
+            core.info(`Comment: ${comment}`);
+            await postComment(comment, pr);
+
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
new file mode 100644
index 0000000000..5d16915e10
--- /dev/null
+++ b/.github/workflows/publish.yml
@@ -0,0 +1,114 @@
+name: Publish Ruby packages
+
+on:
+  repository_dispatch:
+    types:
+      - release
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'Version of the Ruby package to release'
+        required: true
+        default: '4.0.0'
+
+permissions:
+  contents: read
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - uses: ruby/setup-ruby@afeafc3d1ab54a631816aba4c914a0081c12ff2f # v1.310.0
+        with:
+          ruby-version: 3.3.4
+
+      - name: Store Ruby version
+        env:
+          RUBY_VERSION: ${{ github.event.client_payload.version || github.event.inputs.version }}
+        run: |
+          echo "RUBY_VERSION=${RUBY_VERSION}" >> $GITHUB_ENV
+
+      - name: Store ABI version
+        run: echo "ABI_VERSION=$(echo ${RUBY_VERSION} | cut -d '.' -f 1-2)" >> $GITHUB_ENV
+
+      - name: Copy draft package `/tmp` to `/pub` directory
+        run: tool/release.sh ${RUBY_VERSION}
+        env:
+          AWS_ACCESS_KEY_ID: ${{ secrets.FTP_R_L_O_AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.FTP_R_L_O_AWS_SECRET_ACCESS_KEY }}
+          AWS_DEFAULT_REGION: us-west-2
+
+      - name: Purge URLs of release package
+        run: |
+          curl -X POST \
+            -H "Fastly-Key: ${{ secrets.FASTLY_PURGE_TOKEN }}" \
+            https://api.fastly.com/purge/cache.ruby-lang.org/pub/ruby/${ABI_VERSION}/ruby-${RUBY_VERSION}.tar.gz
+          curl -X POST \
+            -H "Fastly-Key: ${{ secrets.FASTLY_PURGE_TOKEN }}" \
+            https://api.fastly.com/purge/cache.ruby-lang.org/pub/ruby/${ABI_VERSION}/ruby-${RUBY_VERSION}.tar.xz
+          curl -X POST \
+            -H "Fastly-Key: ${{ secrets.FASTLY_PURGE_TOKEN }}" \
+            https://api.fastly.com/purge/cache.ruby-lang.org/pub/ruby/${ABI_VERSION}/ruby-${RUBY_VERSION}.zip
+
+      - name: Create a release on GitHub
+        run: |
+          RELEASE_TAG=$(ruby tool/ruby-version.rb tag "${RUBY_VERSION}")
+          echo $RELEASE_TAG
+          PREVIOUS_RELEASE_TAG=$(ruby tool/ruby-version.rb previous-tag "${RUBY_VERSION}")
+          echo $PREVIOUS_RELEASE_TAG
+          tool/gen-github-release.rb $PREVIOUS_RELEASE_TAG $RELEASE_TAG --no-dry-run
+        env:
+          GITHUB_TOKEN: ${{ secrets.MATZBOT_AUTO_UPDATE_TOKEN }}
+
+      - name: Update versions index
+        run: |
+          curl -L -X POST \
+            -H "Authorization: Bearer ${{ secrets.MATZBOT_GITHUB_WORKFLOW_TOKEN }}" \
+            -H "Accept: application/vnd.github+json" \
+            -H "X-GitHub-Api-Version: 2022-11-28" \
+            https://api.github.com/repos/ruby/actions/dispatches \
+            -d '{"event_type": "update_index"}'
+
+      - name: Build and push Docker images
+        run: |
+          curl -L -X POST \
+            -H "Authorization: Bearer ${{ secrets.MATZBOT_GITHUB_WORKFLOW_TOKEN }}" \
+            -H "Accept: application/vnd.github+json" \
+            -H "X-GitHub-Api-Version: 2022-11-28" \
+            https://api.github.com/repos/ruby/docker-images/dispatches \
+            -d "{\"event_type\": \"build\", \"client_payload\": {\"ruby_version\": \"${RUBY_VERSION}\"}}"
+
+      - name: Build snapcraft packages
+        run: |
+          curl -L -X POST \
+            -H "Authorization: Bearer ${{ secrets.MATZBOT_GITHUB_WORKFLOW_TOKEN }}" \
+            -H "Accept: application/vnd.github+json" \
+            -H "X-GitHub-Api-Version: 2022-11-28" \
+            https://api.github.com/repos/ruby/snap.ruby/dispatches \
+            -d "{\"event_type\": \"build\", \"client_payload\": {\"ruby_version\": \"${RUBY_VERSION}\"}}"
+
+      - name: Store the latest LTS version of OpenSSL
+        run: |
+          echo "OPENSSL_VERSION=`curl -s https://api.github.com/repos/openssl/openssl/releases | jq -r '.[].tag_name | select(startswith("openssl-3.0"))' | sort -Vr | head -n1 | cut -d'-' -f2`" >> $GITHUB_ENV
+
+      - name: Update ruby-build definition
+        run: |
+          curl -L -X POST \
+            -H "Authorization: Bearer ${{ secrets.RUBY_BUILD_WORKFLOW_TOKEN }}" \
+            -H "Accept: application/vnd.github+json" \
+            -H "X-GitHub-Api-Version: 2022-11-28" \
+            https://api.github.com/repos/rbenv/ruby-build/dispatches \
+            -d "{\"event_type\": \"update-ruby\", \"client_payload\": {\"ruby_version\": \"${RUBY_VERSION}\", \"openssl_version\": \"${OPENSSL_VERSION}\"}}"
+
+      - name: Update all-ruby definition
+        run: |
+          curl -L -X POST \
+            -H "Authorization: Bearer ${{ secrets.MATZBOT_GITHUB_WORKFLOW_TOKEN }}" \
+            -H "Accept: application/vnd.github+json" \
+            -H "X-GitHub-Api-Version: 2022-11-28" \
+            https://api.github.com/repos/ruby/all-ruby/dispatches \
+            -d '{"event_type": "update"}'
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 0000000000..a35bcff99a
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,21 @@
+name: Start release workflow
+on:
+  push:
+    tags:
+      - '*'
+
+permissions:
+  contents: read
+
+jobs:
+  notify:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Build release package
+        run: |
+          curl -L -X POST \
+            -H "Authorization: Bearer ${{ secrets.MATZBOT_GITHUB_WORKFLOW_TOKEN }}" \
+            -H "Accept: application/vnd.github+json" \
+            -H "X-GitHub-Api-Version: 2022-11-28" \
+            https://api.github.com/repos/ruby/actions/dispatches \
+            -d "{\"event_type\": \"$GITHUB_REF\"}"
diff --git a/.github/workflows/rust-warnings.yml b/.github/workflows/rust-warnings.yml
new file mode 100644
index 0000000000..23ed164405
--- /dev/null
+++ b/.github/workflows/rust-warnings.yml
@@ -0,0 +1,62 @@
+# Surface Rust warnings on PRs that touch any Rust code.
+# Not a required check so we never block people over new warnings
+# that might come from a new Rust version being released.
+name: Rust warnings
+on:
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+    paths:
+      - '**.rs'
+      - '!**.inc.rs'
+  merge_group:
+
+concurrency:
+  group: ${{ github.workflow }} / ${{ startsWith(github.event_name, 'pull') && github.ref_name || github.sha }}
+  cancel-in-progress: ${{ startsWith(github.event_name, 'pull') }}
+
+permissions:
+  contents: read
+
+jobs:
+  rust-warnings:
+    env:
+      GITPULLOPTIONS: --no-tags origin ${{ github.ref }}
+
+    runs-on: ubuntu-24.04
+
+    if: >-
+      ${{!(false
+      || contains(github.event.head_commit.message, '[DOC]')
+      || contains(github.event.pull_request.title, '[DOC]')
+      || contains(github.event.pull_request.labels.*.name, 'Documentation')
+      || (github.event.pull_request.user.login == 'dependabot[bot]' && !startsWith(github.head_ref, 'dependabot/cargo'))
+      )}}
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Install Rust
+        run: rustup default beta
+
+      - name: Rust warnings
+        shell: bash
+        run: |
+          set -eu
+          cargo check --quiet --all-features --message-format=json \
+            | jq -r 'select(.message.level | IN("warning", "error")) | .message.rendered' \
+            | tee messages.txt
+          (exit "${PIPESTATUS[0]}") && ! grep --quiet '[^[:space:]]' messages.txt
+
+      - name: "📜 `rustdoc` warnings"
+        shell: bash
+        run: |
+          set -eu
+          cargo doc --document-private-items --all --no-deps --message-format=json \
+            | jq -r 'select(.message.level | IN("warning", "error")) | .message.rendered' \
+            | tee messages.txt
+          (exit "${PIPESTATUS[0]}") && ! grep --quiet '[^[:space:]]' messages.txt
diff --git a/.github/workflows/scorecards.yml b/.github/workflows/scorecards.yml
new file mode 100644
index 0000000000..74c13f98fa
--- /dev/null
+++ b/.github/workflows/scorecards.yml
@@ -0,0 +1,78 @@
+# This workflow uses actions that are not certified by GitHub. They are provided
+# by a third-party and are governed by separate terms of service, privacy
+# policy, and support documentation.
+
+name: Scorecard supply-chain security
+on:
+  # For Branch-Protection check. Only the default branch is supported. See
+  # https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection
+  branch_protection_rule:
+  # To guarantee Maintained check is occasionally updated. See
+  # https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained
+  schedule:
+    - cron: '39 3 * * 5'
+  # push:
+  #   branches: [ "master" ]
+
+# Declare default permissions as read only.
+permissions: read-all
+
+jobs:
+  analysis:
+    name: Scorecard analysis
+    runs-on: ubuntu-latest
+    # `publish_results: true` only works when run from the default branch. conditional can be removed if disabled.
+    if: github.event.repository.default_branch == github.ref_name || github.event_name == 'pull_request'
+    permissions:
+      # Needed to upload the results to code-scanning dashboard.
+      security-events: write
+      # Needed to publish results and get a badge (see publish_results below).
+      id-token: write
+      # Uncomment the permissions below if installing in a private repository.
+      # contents: read
+      # actions: read
+
+    steps:
+      - name: "Checkout code"
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: "Run analysis"
+        uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          # (Optional) "write" PAT token. Uncomment the `repo_token` line below if:
+          # - you want to enable the Branch-Protection check on a *public* repository, or
+          # - you are installing Scorecard on a *private* repository
+          # To create the PAT, follow the steps in https://github.com/ossf/scorecard-action?tab=readme-ov-file#authentication-with-fine-grained-pat-optional.
+          # repo_token: ${{ secrets.SCORECARD_TOKEN }}
+
+          # Public repositories:
+          #   - Publish results to OpenSSF REST API for easy access by consumers
+          #   - Allows the repository to include the Scorecard badge.
+          #   - See https://github.com/ossf/scorecard-action#publishing-results.
+          # For private repositories:
+          #   - `publish_results` will always be set to `false`, regardless
+          #     of the value entered here.
+          publish_results: true
+
+          # (Optional) Uncomment file_mode if you have a .gitattributes with files marked export-ignore
+          # file_mode: git
+
+      # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
+      # format to the repository Actions tab.
+      - name: "Upload artifact"
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: SARIF file
+          path: results.sarif
+          retention-days: 5
+
+      # Upload the results to GitHub's code scanning dashboard (optional).
+      # Commenting out will disable upload of results to your repo's Code Scanning dashboard
+      - name: "Upload to code-scanning"
+        uses: github/codeql-action/upload-sarif@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0
+        with:
+          sarif_file: results.sarif
diff --git a/.github/workflows/spec_guards.yml b/.github/workflows/spec_guards.yml
new file mode 100644
index 0000000000..856b6e434e
--- /dev/null
+++ b/.github/workflows/spec_guards.yml
@@ -0,0 +1,68 @@
+name: Rubyspec Version Guards Check
+
+on:
+  push:
+    paths:
+      - '.github/workflows/spec_guards.yml'
+      - 'spec/**'
+      - '!spec/*.md'
+  pull_request:
+    paths:
+      - '.github/workflows/spec_guards.yml'
+      - 'spec/**'
+      - '!spec/*.md'
+  merge_group:
+
+concurrency:
+  group: ${{ github.workflow }} / ${{ startsWith(github.event_name, 'pull') && github.ref_name || github.sha }}
+  cancel-in-progress: ${{ startsWith(github.event_name, 'pull') }}
+
+permissions:
+  contents: read
+
+jobs:
+  rubyspec:
+    name: Rubyspec
+
+    runs-on: ubuntu-22.04
+
+    if: >-
+      ${{!(false
+      || contains(github.event.head_commit.message, '[DOC]')
+      || contains(github.event.pull_request.title, '[DOC]')
+      || contains(github.event.pull_request.labels.*.name, 'Documentation')
+      || (github.event.pull_request.user.login == 'dependabot[bot]')
+      )}}
+
+    strategy:
+      matrix:
+        # Specs from ruby/spec should still run on all supported Ruby versions.
+        # This also ensures the needed ruby_version_is guards are there, see spec/README.md.
+        ruby:
+          - ruby-3.3
+          - ruby-3.4
+          - ruby-4.0
+      fail-fast: false
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - uses: ruby/setup-ruby@afeafc3d1ab54a631816aba4c914a0081c12ff2f # v1.310.0
+        with:
+          ruby-version: ${{ matrix.ruby }}
+          bundler: none
+
+      - run: gem install webrick
+
+      - run: ruby ../mspec/bin/mspec
+        working-directory: spec/ruby
+        env:
+          CHECK_LEAKS: true
+
+      - uses: ./.github/actions/slack
+        with:
+          label: ${{ matrix.ruby }}
+          SLACK_WEBHOOK_URL: ${{ secrets.SIMPLER_ALERTS_URL }} # ruby-lang slack: ruby/simpler-alerts-bot
+        if: ${{ failure() }}
diff --git a/.github/workflows/sync_default_gems.yml b/.github/workflows/sync_default_gems.yml
new file mode 100644
index 0000000000..9fd1945449
--- /dev/null
+++ b/.github/workflows/sync_default_gems.yml
@@ -0,0 +1,80 @@
+name: Sync default gems
+
+env:
+  DEFAULT_GEM_SYNC_ENABLED: true
+
+on:
+  workflow_dispatch:
+    inputs:
+      gem:
+        required: true
+        description: 'Name of the gem to be synchronized'
+        type: string
+      before:
+        required: true
+        description: 'Gem commit SHA before sync'
+        type: string
+      after:
+        required: true
+        description: 'Gem commit SHA after sync'
+        type: string
+
+permissions:
+  contents: read
+
+jobs:
+  sync_default_gems:
+    name: Sync default gem ${{ github.event.inputs.gem }}
+
+    permissions:
+      contents: write # for Git to git push
+
+    runs-on: ubuntu-latest
+
+    if: ${{ github.repository == 'ruby/ruby' }}
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 # zizmor: ignore[artipacked]
+        name: Check out ruby/ruby
+        with:
+          token: ${{ github.repository == 'ruby/ruby' && secrets.MATZBOT_AUTO_UPDATE_TOKEN || secrets.GITHUB_TOKEN }}
+
+      - uses: ruby/setup-ruby@afeafc3d1ab54a631816aba4c914a0081c12ff2f # v1.310.0
+        with:
+          ruby-version: '3.4'
+          bundler: none
+
+      - name: Run tool/sync_default_gems.rb
+        id: sync
+        run: |
+          ruby_before=$(git rev-parse HEAD)
+          set -x
+          ruby tool/sync_default_gems.rb "${gem_name}" "${gem_before}..${gem_after}"
+          if [[ "$(git rev-parse HEAD)" != "$ruby_before" ]]; then
+            echo update=true >> $GITHUB_OUTPUT
+          fi
+        env:
+          gem_name: ${{ github.event.inputs.gem }}
+          gem_before: ${{ github.event.inputs.before }}
+          gem_after: ${{ github.event.inputs.after }}
+          EMAIL: svn-admin@ruby-lang.org
+          GIT_AUTHOR_NAME: git
+          GIT_COMMITTER_NAME: git
+
+      - name: Push
+        run: |
+          git pull --rebase origin ${GITHUB_REF#refs/heads/}
+          git push origin ${GITHUB_REF#refs/heads/}
+        if: ${{ steps.sync.outputs.update && env.DEFAULT_GEM_SYNC_ENABLED == 'true' }}
+        env:
+          EMAIL: svn-admin@ruby-lang.org
+          GIT_AUTHOR_NAME: git
+          GIT_COMMITTER_NAME: git
+
+      - uses: ./.github/actions/slack
+        with:
+          SLACK_WEBHOOK_URL: ${{ secrets.SIMPLER_ALERTS_URL }} # ruby-lang slack: ruby/simpler-alerts-bot
+          label: "${{ github.event.inputs.gem }} (<https://github.com/${{ github.event.inputs.gem == 'rubygems' && 'rubygems' || 'ruby' }}/${{ github.event.inputs.gem }}/compare/${{ github.event.inputs.before }}...${{ github.event.inputs.after }}|diff>)"
+          event_name: workflow_dispatch
+          extra_channel_id: C05FPKAU743 # alerts-sync
+        if: ${{ failure() }}
diff --git a/.github/workflows/tarball-macos.yml b/.github/workflows/tarball-macos.yml
new file mode 100644
index 0000000000..9bec94d528
--- /dev/null
+++ b/.github/workflows/tarball-macos.yml
@@ -0,0 +1,101 @@
+name: tarball-macos (reusable)
+
+on:
+  workflow_call:
+    inputs:
+      archname:
+        description: 'archname (e.g. snapshot-master, snapshot-ruby_3_3)'
+        required: true
+        type: string
+      notify-release-channel:
+        description: 'Also send failure notifications to SNAPSHOT_SLACK_WEBHOOK_URL (schedule/release builds).'
+        required: false
+        type: boolean
+        default: false
+    secrets:
+      SIMPLER_ALERTS_URL:
+        required: false
+      SNAPSHOT_SLACK_WEBHOOK_URL:
+        required: false
+
+permissions:
+  contents: read
+
+jobs:
+  macos:
+    strategy:
+      matrix:
+        test_task: [check, test-bundled-gems, test-bundler-parallel]
+        os: [macos-26, macos-15, macos-14]
+        include:
+          - os: macos-15-intel
+            test_task: check
+      fail-fast: false
+    runs-on: ${{ matrix.os }}
+    env:
+      ARCHNAME: ${{ inputs.archname }}
+    steps:
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: Packages
+          path: pkg
+      - name: Extract
+        run: tar xf pkg/*.tar.xz
+      - name: Install libraries
+        run: |
+          with_retry () {
+            "$@" || { sleep 5 && "$@"; } || { sleep 60 && "$@"; }
+          }
+          set -x
+          with_retry brew install gmp libffi openssl zlib autoconf automake libtool libyaml
+      - name: Set ENV
+        run: |
+          echo "JOBS=-j$((1 + $(sysctl -n hw.activecpu)))" >> $GITHUB_ENV
+      - name: configure
+        run: cd "$ARCHNAME/" && ./configure --with-openssl-dir=$(brew --prefix openssl) --with-libyaml-dir=$(brew --prefix libyaml)
+      - name: make
+        run: cd "$ARCHNAME/" && make $JOBS
+      - name: Tests
+        run: cd "$ARCHNAME/" && make $JOBS -s ${{ matrix.test_task }}
+        env:
+          RUBY_TESTOPTS: "-q --tty=no"
+          RUBY_DEBUG_TEST_NO_REMOTE: "1"
+      # leaked-globals since 2.7
+      - name: Leaked Globals
+        run: cd "$ARCHNAME/" && make -s leaked-globals
+        if: matrix.test_task == 'check'
+      - name: make install without root privilege
+        run: cd "$ARCHNAME/" && make $JOBS install DESTDIR="/tmp/destdir"
+        if: matrix.test_task == 'check'
+      - name: make install
+        run: cd "$ARCHNAME/" && sudo make $JOBS install
+        if: matrix.test_task == 'check'
+      - name: Verify installed binaries
+        run: |
+          /usr/local/bin/ruby -v
+          /usr/local/bin/gem -v
+          /usr/local/bin/bundle -v
+        if: matrix.test_task == 'check'
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          sparse-checkout: .github/actions/slack
+          sparse-checkout-cone-mode: false
+          persist-credentials: false
+        if: ${{ failure() }}
+      - uses: ./.github/actions/slack
+        with:
+          label: "${{ matrix.os }} / ${{ matrix.test_task }}"
+          SLACK_WEBHOOK_URL: ${{ secrets.SIMPLER_ALERTS_URL }} # ruby-lang slack: ruby/simpler-alerts-bot
+        if: ${{ failure() }}
+      - uses: ruby/action-slack@d260b61aa817726d5bedd22dd6cc305787fa4cdd # v4.0.0
+        with:
+          payload: |
+            {
+              "attachments": [{
+                "text": "${{ job.status }}: ${{ matrix.os }} / ${{ matrix.test_task }} <https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}|${{ inputs.archname }}>",
+                "color": "danger"
+              }]
+            }
+        env:
+          SLACK_WEBHOOK_URL: ${{ secrets.SNAPSHOT_SLACK_WEBHOOK_URL }}
+        if: failure() && inputs.notify-release-channel
diff --git a/.github/workflows/tarball-non-development.yml b/.github/workflows/tarball-non-development.yml
new file mode 100644
index 0000000000..db6230b301
--- /dev/null
+++ b/.github/workflows/tarball-non-development.yml
@@ -0,0 +1,87 @@
+name: tarball-non-development (reusable)
+
+on:
+  workflow_call: {}
+
+permissions:
+  contents: read
+
+jobs:
+  non_development:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - { variant: default,     remove_ruby: false, configure_extra: '' }
+          - { variant: no-ruby,     remove_ruby: true,  configure_extra: '' }
+          - { variant: baseruby-no, remove_ruby: false, configure_extra: '--with-baseruby=no' }
+    runs-on: ubuntu-24.04
+    env:
+      ruby_prefix: /tmp/ruby-snapshot
+    steps:
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: Packages
+          path: pkg
+      - name: Extract
+        run: tar xf pkg/*.tar.xz
+      - name: Substitute patchlevel
+        run: |
+          set -x
+          cd snapshot-*/
+          sed -i.orig 's/^\( *# *define  *RUBY_PATCHLEVEL\)  *-.*/\1 0/' version.h
+          diff -u version.h.orig version.h || :
+          rm -f version.h.orig
+      - name: Install libraries
+        run: |
+          set -x
+          sudo apt-get update -q || :
+          sudo apt-get install --no-install-recommends -q -y build-essential libssl-dev libyaml-dev zlib1g-dev libffi-dev libgmp-dev bison- autoconf-
+      - name: Remove host ruby
+        if: matrix.remove_ruby
+        run: |
+          set -x
+          sudo apt-get purge -y -q 'ruby*' || :
+          sudo rm -rf /opt/hostedtoolcache/Ruby
+          ! command -v ruby
+      - name: Set ENV
+        run: |
+          echo "JOBS=-j$((1 + $(nproc --all)))" >> $GITHUB_ENV
+      - name: configure
+        run: cd snapshot-*/ && ./configure --prefix="${ruby_prefix}" ${{ matrix.configure_extra }}
+      - name: make
+        run: cd snapshot-*/ && make $JOBS
+      - name: Leaked Globals
+        run: cd snapshot-*/ && make -s leaked-globals
+      - name: make install
+        run: cd snapshot-*/ && make $JOBS install
+      - name: Set PATH
+        run: echo "PATH=${ruby_prefix}/bin:$PATH" >> $GITHUB_ENV
+      - name: Check patchlevel
+        id: check-patchlevel
+        run: |
+          exec "${ruby_prefix}/bin/ruby" -vx "$0"
+          #!ruby
+          puts "RUBY_PATCHLEVEL=#{RUBY_PATCHLEVEL.inspect}"
+          abort unless RUBY_PATCHLEVEL >= 0
+        working-directory: ${{ env.ruby_prefix }}
+        continue-on-error: true
+      - name: Check LOADPATH
+        id: check-loadpath
+        run: |
+          exec ${ruby_prefix}/bin/ruby -vx "$0"
+          #!ruby
+          paths = $:.grep(/\+/)
+          pp paths
+          abort unless paths.empty?
+        working-directory: ${{ env.ruby_prefix }}
+        continue-on-error: true
+      - name: Check pathnames
+        id: check-pathnames
+        run: |
+          ! find -name '*+*' | grep +
+        working-directory: ${{ env.ruby_prefix }}
+        continue-on-error: true
+      - name: result
+        run: false
+        if: ${{ contains(steps.*.outcome, 'failure') }}
diff --git a/.github/workflows/tarball-test-schedule.yml b/.github/workflows/tarball-test-schedule.yml
new file mode 100644
index 0000000000..6684b09edb
--- /dev/null
+++ b/.github/workflows/tarball-test-schedule.yml
@@ -0,0 +1,26 @@
+name: tarball-test-schedule
+on:
+  schedule:
+    - cron: '30 18 * * *' # Daily at 18:30 UTC
+  workflow_dispatch:
+
+permissions: {}
+
+jobs:
+  dispatch:
+    if: ${{ github.event_name != 'schedule' || github.repository == 'ruby/ruby' }}
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        branch:
+          - master
+          - ruby_4_0
+          - ruby_3_4
+          - ruby_3_3
+    steps:
+      - name: Trigger tarball-test on ${{ matrix.branch }}
+        run: gh workflow run tarball-test.yml --ref "$BRANCH" --repo "$GITHUB_REPOSITORY" -f notify-release-channel=true
+        env:
+          BRANCH: ${{ matrix.branch }}
+          GH_TOKEN: ${{ secrets.MATZBOT_GITHUB_ACTION_TOKEN }}
diff --git a/.github/workflows/tarball-test.yml b/.github/workflows/tarball-test.yml
new file mode 100644
index 0000000000..52c4d31fc8
--- /dev/null
+++ b/.github/workflows/tarball-test.yml
@@ -0,0 +1,105 @@
+name: tarball-test
+on:
+  push:
+    paths-ignore:
+      - 'doc/**'
+      - '**/man/*'
+      - '**.md'
+      - '**.rdoc'
+      - '**/.document'
+      - '.*.yml'
+  pull_request:
+    # Do not use paths-ignore for required status checks
+    # https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/collaborating-on-repositories-with-code-quality-features/troubleshooting-required-status-checks#handling-skipped-but-required-checks
+  merge_group:
+  workflow_dispatch:
+    inputs:
+      notify-release-channel:
+        description: 'Also send failure notifications to SNAPSHOT_SLACK_WEBHOOK_URL (set by tarball-test-schedule).'
+        type: boolean
+        default: false
+
+concurrency:
+  group: ${{ github.workflow }} / ${{ startsWith(github.event_name, 'pull') && github.ref_name || github.sha }}
+  cancel-in-progress: ${{ startsWith(github.event_name, 'pull') }}
+
+permissions:
+  contents: read
+
+jobs:
+  tarball:
+    runs-on: ubuntu-latest
+    # Cherry-pick to maintenance branches by changing only env.BRANCH below;
+    # archname / branch-label / Materialize all derive from it.
+    env:
+      BRANCH: master
+    outputs:
+      branch: ${{ env.BRANCH }}
+      skip: ${{ steps.skipping.outputs.skip }}
+    steps:
+      - id: skipping
+        run:
+          echo 'skip=true' >> $GITHUB_OUTPUT
+        if: >-
+          ${{(false
+          || contains(github.event.head_commit.message, '[DOC]')
+          || contains(github.event.pull_request.title, '[DOC]')
+          || contains(github.event.pull_request.labels.*.name, 'Documentation')
+          || (github.event.pull_request.user.login == 'dependabot[bot]')
+          )}}
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 1 # actions/checkout fetches all heads/tags unless > 0
+          persist-credentials: false
+      # tool/make-snapshot derives the branch name from HEAD and looks up
+      # the upstream during ChangeLog generation. Detached checkouts
+      # (pull_request, merge_group) lack a local branch with tracking, so
+      # pin one to HEAD and connect it to the matching origin ref.
+      - name: Materialize local branch
+        run: |
+          git fetch --no-tags --depth=1 origin "+refs/heads/$BASE:refs/remotes/origin/$BASE"
+          git checkout -B "$BRANCH" HEAD
+          git branch --set-upstream-to="origin/$BASE" "$BRANCH"
+        env:
+          BASE: ${{ github.base_ref || env.BRANCH }}
+      - uses: ./.github/actions/make-snapshot
+        with:
+          archname: snapshot-${{ env.BRANCH }}
+          srcdir: '.'
+
+  ubuntu:
+    needs: tarball
+    if: ${{ ! needs.tarball.outputs.skip }}
+    uses: ./.github/workflows/tarball-ubuntu.yml
+    with:
+      archname: snapshot-${{ needs.tarball.outputs.branch }}
+      notify-release-channel: ${{ github.event_name == 'workflow_dispatch' && inputs.notify-release-channel || false }}
+    secrets:
+      SIMPLER_ALERTS_URL: ${{ secrets.SIMPLER_ALERTS_URL }}
+      SNAPSHOT_SLACK_WEBHOOK_URL: ${{ secrets.SNAPSHOT_SLACK_WEBHOOK_URL }}
+
+  macos:
+    needs: tarball
+    if: ${{ ! needs.tarball.outputs.skip }}
+    uses: ./.github/workflows/tarball-macos.yml
+    with:
+      archname: snapshot-${{ needs.tarball.outputs.branch }}
+      notify-release-channel: ${{ github.event_name == 'workflow_dispatch' && inputs.notify-release-channel || false }}
+    secrets:
+      SIMPLER_ALERTS_URL: ${{ secrets.SIMPLER_ALERTS_URL }}
+      SNAPSHOT_SLACK_WEBHOOK_URL: ${{ secrets.SNAPSHOT_SLACK_WEBHOOK_URL }}
+
+  windows:
+    needs: tarball
+    if: ${{ ! needs.tarball.outputs.skip }}
+    uses: ./.github/workflows/tarball-windows.yml
+    with:
+      archname: snapshot-${{ needs.tarball.outputs.branch }}
+      notify-release-channel: ${{ github.event_name == 'workflow_dispatch' && inputs.notify-release-channel || false }}
+    secrets:
+      SIMPLER_ALERTS_URL: ${{ secrets.SIMPLER_ALERTS_URL }}
+      SNAPSHOT_SLACK_WEBHOOK_URL: ${{ secrets.SNAPSHOT_SLACK_WEBHOOK_URL }}
+
+  non_development:
+    needs: tarball
+    uses: ./.github/workflows/tarball-non-development.yml
diff --git a/.github/workflows/tarball-ubuntu.yml b/.github/workflows/tarball-ubuntu.yml
new file mode 100644
index 0000000000..03f2f946b5
--- /dev/null
+++ b/.github/workflows/tarball-ubuntu.yml
@@ -0,0 +1,150 @@
+name: tarball-ubuntu (reusable)
+
+on:
+  workflow_call:
+    inputs:
+      archname:
+        description: 'archname (e.g. snapshot-master, snapshot-ruby_3_3)'
+        required: true
+        type: string
+      notify-release-channel:
+        description: 'Also send failure notifications to SNAPSHOT_SLACK_WEBHOOK_URL (schedule/release builds).'
+        required: false
+        type: boolean
+        default: false
+    secrets:
+      SIMPLER_ALERTS_URL:
+        required: false
+      SNAPSHOT_SLACK_WEBHOOK_URL:
+        required: false
+
+permissions:
+  contents: read
+
+jobs:
+  ubuntu:
+    strategy:
+      matrix:
+        test_task: [check, test-bundler-parallel, test-bundled-gems]
+        os: [ubuntu-24.04, ubuntu-22.04]
+      fail-fast: false
+    runs-on: ${{ matrix.os }}
+    env:
+      ARCHNAME: ${{ inputs.archname }}
+    steps:
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: Packages
+          path: pkg
+      - name: Extract
+        run: tar xf pkg/*.tar.xz
+      - name: Install libraries
+        run: |
+          set -x
+          sudo apt-get update -q
+          sudo apt-get install --no-install-recommends -q -y build-essential libssl-dev libyaml-dev zlib1g-dev libffi-dev libgmp-dev bison- autoconf-
+      - uses: ruby/setup-ruby@afeafc3d1ab54a631816aba4c914a0081c12ff2f # v1.310.0
+        with:
+          ruby-version: '3.2'
+        # test-bundled-gems requires executable host ruby
+        if: matrix.test_task == 'test-bundled-gems'
+      - name: Fixed world writable dirs
+        run: |
+          mkdir -p $HOME/.local/share
+          mkdir -p $HOME/.cache/gem/specs
+          mkdir -p $HOME/.bundle/cache
+          mkdir -p $HOME/.ssh
+          chmod a-w $HOME/.bundle
+          # chmod a-w $HOME
+          # allow to write $HOME and check stats of HOME around tests (see below)
+          chmod -v a-w $HOME/.config
+          sudo chmod -R a-w /usr/share
+          sudo bash -c 'IFS=:; for d in '"$PATH"'; do chmod -v a-w $d; done' || :
+      - name: Set ENV
+        run: |
+          echo "JOBS=-j$((1 + $(nproc --all)))" >> $GITHUB_ENV
+      - name: configure
+        run: cd "$ARCHNAME/" && ./configure
+      - name: make
+        run: cd "$ARCHNAME/" && make $JOBS
+      - name: Save stats of HOME
+        run: |
+          set -euxo pipefail
+          cat >"$ARCHNAME/save-stats.rb" <<'EOF'
+          require 'pathname'
+          require 'digest'
+          out = []
+          [
+            Dir.home,
+          ].each do |dir|
+            Dir.each_child(dir) do |pn|
+              st = File.stat(pn)
+              if st.file?
+                content = Digest::SHA1.file(pn).hexdigest
+              elsif st.directory? && st.nlink <= 10
+                content = Dir.children(pn).sort
+              end
+              out << [pn, "%o"%st.mode, st.nlink, st.uid, st.gid, st.size, content].to_s
+            rescue
+              out << [pn, $!.inspect].to_s
+            end
+          end
+          File.open(ARGV.shift, "w") do |io|
+            io.puts out.sort
+          end
+          EOF
+          make -C "$ARCHNAME" TESTRUN_SCRIPT=save-stats.rb RUNOPT=/tmp/stat-before-tests.txt runruby
+      - name: Tests
+        run: cd "$ARCHNAME/" && make $JOBS -s ${{ matrix.test_task }}
+        env:
+          RUBY_TESTOPTS: "-q --tty=no"
+      # test_sync_default_gems triggers gpg, whose agent processes leave
+      # $HOME/.gnupg around even when GNUPGHOME points elsewhere.
+      - name: Forcibly remove ~/.gnupg
+        run: rm -rf $HOME/.gnupg
+      - name: Diff stats of HOME
+        run: |
+          make -C "$ARCHNAME" TESTRUN_SCRIPT=save-stats.rb RUNOPT=/tmp/stat-after-tests.txt runruby
+          rm -f "$ARCHNAME/save-stats.rb"
+          diff -u /tmp/stat-before-tests.txt /tmp/stat-after-tests.txt
+      # leaked-globals since 2.7
+      - name: Leaked Globals
+        run: cd "$ARCHNAME/" && make -s leaked-globals
+        if: matrix.test_task == 'check'
+      - name: make install without root privilege
+        run: cd "$ARCHNAME/" && make $JOBS install DESTDIR="/tmp/destdir"
+        if: matrix.test_task == 'check'
+      - name: make install
+        run: cd "$ARCHNAME/" && sudo make $JOBS install
+        if: matrix.test_task == 'check'
+      - name: Verify installed binaries
+        run: |
+          /usr/local/bin/ruby -v
+          /usr/local/bin/gem -v
+          /usr/local/bin/bundle -v
+        if: matrix.test_task == 'check'
+      - name: Show .local
+        run: find $HOME/.local -ls
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          sparse-checkout: .github/actions/slack
+          sparse-checkout-cone-mode: false
+          persist-credentials: false
+        if: ${{ failure() }}
+      - uses: ./.github/actions/slack
+        with:
+          label: "${{ matrix.os }} / ${{ matrix.test_task }}"
+          SLACK_WEBHOOK_URL: ${{ secrets.SIMPLER_ALERTS_URL }} # ruby-lang slack: ruby/simpler-alerts-bot
+        if: ${{ failure() }}
+      - uses: ruby/action-slack@d260b61aa817726d5bedd22dd6cc305787fa4cdd # v4.0.0
+        with:
+          payload: |
+            {
+              "attachments": [{
+                "text": "${{ job.status }}: ${{ matrix.os }} / ${{ matrix.test_task }} <https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}|${{ inputs.archname }}>",
+                "color": "danger"
+              }]
+            }
+        env:
+          SLACK_WEBHOOK_URL: ${{ secrets.SNAPSHOT_SLACK_WEBHOOK_URL }}
+        if: failure() && inputs.notify-release-channel
diff --git a/.github/workflows/tarball-windows.yml b/.github/workflows/tarball-windows.yml
new file mode 100644
index 0000000000..1ce95de6fc
--- /dev/null
+++ b/.github/workflows/tarball-windows.yml
@@ -0,0 +1,163 @@
+name: tarball-windows (reusable)
+
+on:
+  workflow_call:
+    inputs:
+      archname:
+        description: 'archname (e.g. snapshot-master)'
+        required: true
+        type: string
+      notify-release-channel:
+        description: 'Also send failure notifications to SNAPSHOT_SLACK_WEBHOOK_URL (schedule/release builds).'
+        required: false
+        type: boolean
+        default: false
+    secrets:
+      SIMPLER_ALERTS_URL:
+        required: false
+      SNAPSHOT_SLACK_WEBHOOK_URL:
+        required: false
+
+permissions:
+  contents: read
+
+jobs:
+  windows:
+    strategy:
+      matrix:
+        include:
+          - os: '2022'
+            test_task: check
+          - os: '2025-vs2026'
+            test_task: check
+      fail-fast: false
+    runs-on: windows-${{ matrix.os }}
+    defaults:
+      run:
+        shell: cmd
+        working-directory: build
+    name: Windows ${{ matrix.os }} (${{ matrix.test_task }})
+    env:
+      GITPULLOPTIONS: --no-tags origin ${{github.ref}}
+      PATCH: C:\msys64\usr\bin\patch.exe
+      OS_VER: windows-${{ matrix.os }}
+      # see https://github.com/ruby/ruby/commit/9ff4399decef0036897d3cfb9ac2c710dea913ca
+      OPENSSL_MODULES: C:\vcpkg\installed\x64-windows\bin
+    steps:
+      - run: md build
+        working-directory:
+
+      - uses: ruby/setup-ruby@afeafc3d1ab54a631816aba4c914a0081c12ff2f # v1.310.0
+        with:
+          ruby-version: '3.2'
+          bundler: none
+          windows-toolchain: none
+
+      - uses: msys2/setup-msys2@e9898307ac31d1a803454791be09ab9973336e1c # v2.31.1
+        id: setup-msys2
+        with:
+          update: true
+          install: >-
+            patch
+      - name: patch path
+        shell: msys2 {0}
+        run: echo PATCH=$(cygpath -wa $(command -v patch)) >> $GITHUB_ENV
+        if: ${{ steps.setup-msys2.outcome == 'success' }}
+      - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        with:
+          path: C:\vcpkg\installed
+          key: ${{ runner.os }}-vcpkg-installed-${{ env.OS_VER }}-${{ github.sha }}
+          restore-keys: |
+            ${{ runner.os }}-vcpkg-installed-${{ env.OS_VER }}-
+            ${{ runner.os }}-vcpkg-installed-
+      - name: Install libraries with vcpkg
+        run: |
+          vcpkg --triplet x64-windows install gmp libffi libyaml openssl zlib
+
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: Packages
+          path: pkg
+      - name: Extract
+        run: 7z x pkg/*.zip
+        working-directory:
+
+      - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        with:
+          path: snapshot-*/.downloaded-cache
+          key: downloaded-cache
+
+      - name: setup env
+        # %TEMP% is inconsistent with %TMP% and test-all expects they are consistent.
+        # https://github.com/actions/virtual-environments/issues/712#issuecomment-613004302
+        env:
+          ARCHNAME: ${{ inputs.archname }}
+        run: |
+          set > old.env
+          call ..\%ARCHNAME%\win32\vssetup.cmd
+          set TMP=%USERPROFILE%\AppData\Local\Temp
+          set TEMP=%USERPROFILE%\AppData\Local\Temp
+          set /a TEST_JOBS=(15 * %NUMBER_OF_PROCESSORS% / 10) > nul
+          set > new.env
+
+      - name: update env
+        shell: pwsh
+        run: |
+          $old = (Get-Content old.env); $new = (Get-Content new.env)
+          del *.env
+          Compare-Object $old $new |
+            Where-Object { $_.SideIndicator -eq '=>' } |
+            Select-Object -ExpandProperty InputObject |
+            Add-Content -Path $env:GITHUB_ENV
+      - name: link libraries
+        run: |
+          for %%I in (C:\vcpkg\installed\x64-windows\bin\*.dll) do (
+            mklink %%~nxI %%I
+          )
+      - name: Configure
+        env:
+          ARCHNAME: ${{ inputs.archname }}
+        run: >-
+          ../%ARCHNAME%/win32/configure.bat --disable-install-doc
+          --with-opt-dir=C:/vcpkg/installed/x64-windows
+      - run: nmake incs
+      - run: nmake extract-extlibs
+      - run: nmake
+        env:
+          YACC: win_bison
+
+      - name: ruby -v
+        run: .\ruby -v
+
+      - run: nmake test
+        timeout-minutes: 5
+
+      - run: nmake ${{ matrix.test_task }}
+        env:
+          RUBY_TESTOPTS: -j${{env.TEST_JOBS}}
+        timeout-minutes: 70