Modernize dependencies, add MIT license, and automate releases

.github/workflows/audit.yml

@@ -0,0 +1,31 @@
+name: Audit
+
+# Kept out of ci.yml so a newly published advisory does not block a release that
+# is otherwise green.
+on:
+  push:
+    branches: [master]
+  pull_request:
+    branches: [master]
+  schedule:
+    # Mondays at 13:00 UTC — catches advisories published against the locked
+    # oauth2/rack chain without waiting for the next commit.
+    - cron: "0 13 * * 1"
+  workflow_dispatch:
+
+jobs:
+  audit:
+    name: Dependency audit
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+
+      - uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: .ruby-version
+          bundler-cache: true
+
+      - name: Check for vulnerable dependencies
+        run: |
+          bundle exec bundle-audit update
+          bundle exec bundle-audit check

.github/workflows/ci.yml

@@ -0,0 +1,33 @@
+name: CI
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+    branches: [master]
+  # Lets the release workflow gate publishing on this same matrix.
+  workflow_call:
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        ruby: ["3.2", "3.3", "3.4"]
+
+    name: Ruby ${{ matrix.ruby }}
+    steps:
+      - uses: actions/checkout@v5
+
+      - uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: ${{ matrix.ruby }}
+          bundler-cache: true
+
+      - name: Run the test suite
+        run: bundle exec rake spec
+
+      - name: Build the gem
+        run: bundle exec rake build
+

.github/workflows/release.yml

@@ -0,0 +1,63 @@
+name: Release
+
+# Cut a release from the GitHub Releases UI: draft a release, set the tag to `vX.Y.Z`
+# (matching lib/omniauth-fdc/version.rb), and publish it. GitHub creates the tag,
+# which fires this workflow.
+on:
+  release:
+    types: [published]
+
+jobs:
+  # Never publish a version that has not passed the matrix.
+  test:
+    uses: ./.github/workflows/ci.yml
+
+  push:
+    name: Push gem to RubyGems.org
+    needs: test
+    runs-on: ubuntu-latest
+
+    # Publishing uses RubyGems trusted publishing (OIDC), so there is no API key
+    # secret to rotate and it works with the gemspec's `rubygems_mfa_required`.
+    #
+    # One-time setup on rubygems.org: open the gem -> "Trusted publishers" ->
+    # "Create", with owner `dropstream`, repository `omniauth-fdc`,
+    # workflow `release.yml`, and environment `release`.
+    environment: release
+
+    permissions:
+      id-token: write # mandatory for trusted publishing
+      # GitHub already created the release and its tag, so nothing here writes to
+      # the repo: `rake release` sees the tag and skips its own tag-and-push step.
+      contents: read
+
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          ref: ${{ github.event.release.tag_name }}
+          # rubygems/release-gem installs its own short-lived git credentials.
+          persist-credentials: false
+
+      - uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: .ruby-version
+          bundler-cache: true
+
+      # `rake release` builds whatever version.rb says, regardless of the tag. If the
+      # two disagree it would publish one version under another version's release, so
+      # stop here first.
+      - name: Verify the release tag matches the gem version
+        env:
+          TAG_NAME: ${{ github.event.release.tag_name }}
+        run: |
+          gem_version="$(ruby -r./lib/omniauth-fdc/version -e 'print Omniauth::Fdc::VERSION')"
+          tag_version="${TAG_NAME#v}"
+          if [ "$gem_version" != "$tag_version" ]; then
+            echo "::error::Release tag ${TAG_NAME} does not match lib/omniauth-fdc/version.rb (${gem_version})."
+            exit 1
+          fi
+          echo "Releasing omniauth-fdc ${gem_version}"
+
+      # Builds the gem and runs `gem push` against the gemspec's allowed_push_host.
+      - name: Push to RubyGems.org
+        uses: rubygems/release-gem@v1

.gitignore

@@ -10,3 +10,6 @@
 # rspec failure tracking
 .rspec_status
 *.gem
+
+# macOS
+.DS_Store

.ruby-version

@@ -1 +1 @@
-2.4.4
+3.4.8

CHANGELOG.md

@@ -0,0 +1,63 @@
+# Changelog
+
+All notable changes to this project are documented in this file.
+
+## [0.2.0] - 2026-08-26
+
+### Changed
+
+- **Breaking:** requires `omniauth ~> 2.0` and `omniauth-oauth2 ~> 1.9` (previously an
+  unpinned `omniauth-oauth2`, which resolved to `omniauth 1.9` / `oauth2 1.4`). Host
+  applications must upgrade to OmniAuth 2.x; Rails apps also need
+  [`omniauth-rails_csrf_protection`](https://github.com/cookpad/omniauth-rails_csrf_protection)
+  because OmniAuth 2 only accepts `POST` for the request phase.
+- Pinned the token endpoint to `auth_scheme: :request_body`. `oauth2 2.0` changed its
+  default to `:basic_auth`, which would have moved `client_id`/`client_secret` out of
+  the token request body and changed what Fulfillment.com receives.
+- Requires Ruby >= 3.2 (the modern `oauth2` dependency chain requires it).
+- Development toolchain: Bundler 4.x, `rake ~> 13.0`, `rspec ~> 3.13`.
+- Replaced Travis CI with GitHub Actions, testing Ruby 3.2 through 3.4.
+- Releases are now cut from the GitHub Releases UI: publishing a `vX.Y.Z` release reruns
+  the matrix, checks the tag against `version.rb`, and publishes to RubyGems.org via
+  trusted publishing (OIDC, no stored API key).
+
+### Added
+
+- `LICENSE.txt` (MIT), now declared in the gemspec.
+- A default `client_options[:site]` of `https://auth.fulfillment.com`, so the strategy
+  works without a `setup` lambda. Overriding `client_options[:site]` still wins.
+- Integration specs covering the request phase, the token exchange, the `redirect_uri`
+  override and the auth hash.
+- A weekly `bundle-audit` run, so a new advisory against the locked `oauth2`/`rack`
+  chain surfaces here rather than in a consuming app.
+
+### Fixed
+
+- `callback_url` no longer doubles a mount prefix. The override added `script_name` to
+  `callback_path`, but OmniAuth 2 moved `script_name` into `callback_path` itself, so a
+  strategy mounted under a prefix (for example Devise's `/users`) would have sent
+  `redirect_uri=http://host/users/users/auth/fdc/callback`.
+- Resolved 39 advisories carried by the old locked dependency tree, including
+  `omniauth` CVE-2015-9284 and CVE-2020-36599, `oauth2` CVE-2026-54603, `jwt`
+  CVE-2026-45363, `faraday` CVE-2026-54297, and 30 against `rack 2.2.3`.
+- `bin/console` required a non-existent `omniauth/fdc` file.
+- Development scripts in `bin/` are no longer packaged as gem executables, and the
+  committed `.gem` build artifacts are gone from the repo.
+
+## [0.1.2] - 2020-06-29
+
+- `callback_url` is overridden so query params from a configured `redirect_uri` are not
+  sent to Fulfillment.com (#4).
+
+## [0.1.1] - 2020-05-20
+
+- Raised the `omniauth-oauth2` floor to 1.6 and dropped the upper version constraint.
+
+## [0.1.0] - 2018-10-15
+
+- Initial published strategy.
+
+[0.2.0]: https://github.com/dropstream/omniauth-fdc/releases/tag/v0.2.0
+[0.1.2]: https://rubygems.org/gems/omniauth-fdc/versions/0.1.2
+[0.1.1]: https://rubygems.org/gems/omniauth-fdc/versions/0.1.1
+[0.1.0]: https://rubygems.org/gems/omniauth-fdc/versions/0.1.0

Gemfile

@@ -1,6 +1,14 @@
-source "https://rubygems.org"
+# frozen_string_literal: true
 
-git_source(:github) {|repo_name| "https://github.com/#{repo_name}" }
+source "https://rubygems.org"
 
 # Specify your gem's dependencies in omniauth-fdc.gemspec
 gemspec
+
+group :development, :test do
+  gem "bundler-audit", "~> 0.9"
+  gem "rack-test", "~> 2.2"
+  gem "rake", "~> 13.0"
+  gem "rspec", "~> 3.13"
+  gem "webmock", "~> 3.25"
+end