Modernize dependencies, add MIT license, and automate releases

[kfalconer]

What

The gem still worked, but its dependency chain was from 2020 and the toolchain no longer
ran on a modern Ruby — the pinned Bundler 1.17.3 crashes on Ruby 3.2+ (untaint was
removed). This brings the dependencies current, adds a license, and automates releases.

	before	after
ruby	2.4.4	>= 3.2 (dev on 3.4.8)
bundler	1.17.3	4.0.18
omniauth	1.9.1 (transitive)	2.1.4, now an explicit dependency
omniauth-oauth2	unpinned → 1.6.0	~> 1.9
oauth2	1.4.4	2.0.25
faraday / rack / hashie	1.0.1 / 2.2.2 / 4.1.0	2.14.3 / 3.2.7 / 5.1.0
rake / rspec	10.5 / 3.9	13.4.2 / 3.13.2

Version goes to 0.1.0 — requiring OmniAuth 2 is breaking for host applications.

The one behavior change worth reviewing closely

oauth2 2.0.0 flipped the default auth_scheme from :request_body to :basic_auth,
which silently moves client_id/client_secret out of the token request body and into an
Authorization header. The strategy now pins auth_scheme: :request_body so ShipBob's
/connect/token keeps receiving exactly what it received before, with a spec asserting it.

Configurable API endpoint

Builds on the api_url option from #10 with a channel_url helper, so the channel lookup
follows the configured host and a trailing slash on api_url no longer produces
//channel. Sandbox configuration from the README works unchanged.

Tests

3 → 19 examples. The old specs only asserted two option strings; they would have passed
straight through the auth_scheme change above. The new ones drive the real request phase,
token exchange and callback through rack-test + webmock, including:

• a full sandbox callback, asserting the token exchange hits authstage.shipbob.com while
  the channel lookup hits sandbox-api.shipbob.com/2.0
• the query-param-free redirect_uri from override callback url method to avoid sending query params from given… #7, which an OmniAuth 2 upgrade could easily
  have regressed

Releases

Travis (rvm: 2.4.4) is replaced by two workflows. ci.yml runs the matrix on push/PR and
is exposed via workflow_call; release.yml consumes it so nothing publishes untested.

Cutting a release is a tag push:

# bump lib/omniauth-shipbob/version.rb + add a CHANGELOG section, commit, then:
git tag -a v0.1.0 -m "v0.1.0" && git push origin master --tags

Auth is RubyGems trusted publishing (OIDC), not a stored API key — necessary because
the gemspec sets rubygems_mfa_required, and gem push with an API key would prompt for an
OTP and hang in CI.

The workflow also fails fast if the tag and version.rb disagree. Without that guard,
tagging v0.1.1 against a version.rb of 0.1.0 would publish 0.1.0 and then try to
create a second tag.

Before releases will work

• Register the trusted publisher on rubygems.org — the gem → Trusted publishers →
  Create, with owner dropstream, repository omniauth-shipbob, workflow
  release.yml, environment release. Until this exists the publish step fails auth.
• Merge this first. Tag-triggered workflows run the workflow file from the tagged
  commit, so the first v* tag must already contain release.yml.

Notes

• Ruby 3.1 is not in the matrix. multi_xml 0.9.1 and public_suffix 7.0.5 in the
  resolved set both require >= 3.2, so a 3.1 job would fail at bundle install rather
  than on our code. 3.1 has also been EOL since March 2025.
• Adds LICENSE.txt (MIT, Copyright (c) 2019-2026 Dropstream) and declares it in the
  gemspec. Flagging the license choice explicitly in case Dropstream standardizes on
  something else.
• The built gem now contains only README.md, CHANGELOG.md, LICENSE.txt, the gemspec
  and lib/ — previously bin/setup and bin/console were at risk of being installed as
  executables on consumers' PATH.
• Three stale dependabot branches (omniauth-2.1.0, rack-3.0.4.1, rake-tw-13.0) are
  superseded by this and can be closed.

Verification

• bundle exec rake → 19 examples, 0 failures on Ruby 3.4.8 / Bundler 4.0.18
• gem build warning-free; clean-room gem install of the built gem loads and reports
  auth_scheme=request_body
• Both workflow files parse; actionlint was not available locally, so the action schemas
  are unverified until the first run

🤖 Generated with Claude Code