chore: improve repository quality, metadata, and contributor experience#242
chore: improve repository quality, metadata, and contributor experience#242josecolella merged 3 commits intomainfrom
Conversation
- Fix gemspec URLs (openfeature-ruby → ruby-sdk) and description typo - Add rubygems_mfa_required metadata for security - Move dev dependencies from gemspec to Gemfile - Add CI/coverage/gem version badges to README - Add Ruby version policy and known providers table to README - Fix CONTRIBUTING.md Ruby version (3.0 → 3.4) - Document Standard Ruby linting and Cucumber tests in CONTRIBUTING.md - Add Cucumber conformance and bundler-audit jobs to CI - Add Ruby head to CI matrix with continue-on-error - Create SECURITY.md for vulnerability reporting - Add .yardopts and YARD rake task for API docs - Create examples/ directory (basic_usage, custom_provider, rails_integration) - Add SimpleCov minimum_coverage 90 - Add Gemfile.lock to .gitignore Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Signed-off-by: Jose Colella <jose.colella@gusto.com>
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request aims to enhance the overall quality, metadata, and contributor experience of the Ruby SDK. It aligns the repository with other OpenFeature SDKs and Ruby community best practices by addressing gemspec issues, improving documentation, refining CI/CD processes, and adding new examples and security guidelines. Highlights
Changelog
Ignored Files
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #242 +/- ##
=======================================
Coverage 99.50% 99.50%
=======================================
Files 31 31
Lines 808 808
=======================================
Hits 804 804
Misses 4 4 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces a wide range of improvements to the repository, enhancing quality, metadata, and contributor experience. The changes align the Ruby SDK with other OpenFeature SDKs and community best practices. My review found a couple of areas for improvement: one regarding dependency grouping in the Gemfile for better maintainability, and a more critical issue in a new Rails integration example that could lead to resource leaks if used as-is.
| # def call(env) | ||
| # request = ActionDispatch::Request.new(env) | ||
| # OpenFeature::SDK.set_transaction_context( | ||
| # OpenFeature::SDK::EvaluationContext.new( | ||
| # targeting_key: request.session[:user_id]&.to_s, | ||
| # "ip" => request.remote_ip, | ||
| # "user_agent" => request.user_agent | ||
| # ) | ||
| # ) | ||
| # @app.call(env) | ||
| # end |
There was a problem hiding this comment.
The example OpenFeatureContextMiddleware sets the transaction context using thread-local storage but fails to clear it after the request is complete. In a multi-threaded server environment (like Puma, which is common for Rails), this will cause the context to leak between requests handled by the same thread, leading to incorrect evaluations and potential data exposure. The context should be cleared within an ensure block to guarantee cleanup, even if the request processing raises an error.
# def call(env)
# request = ActionDispatch::Request.new(env)
# OpenFeature::SDK.set_transaction_context(
# OpenFeature::SDK::EvaluationContext.new(
# targeting_key: request.session[:user_id]&.to_s,
# "ip" => request.remote_ip,
# "user_agent" => request.user_agent
# )
# )
# @app.call(env)
# ensure
# # Clear context to prevent leakage in threaded servers.
# OpenFeature::SDK.set_transaction_context(nil)
# endReferences
- Cleanup of thread-local storage is the responsibility of the consumer of the SDK. Automatic cleanup mechanisms should be provided in framework-specific integration gems, not the core SDK.
There was a problem hiding this comment.
Good catch! Fixed — added an ensure block to clear the transaction context after the request completes, preventing thread-local leakage in multi-threaded servers like Puma.
🤖 Jose's AI agent
| group :development, :test do | ||
| gem "debug" | ||
| gem "markly" | ||
| gem "rake", "~> 13.0" | ||
| gem "rspec", "~> 3.12.0" | ||
| gem "standard" | ||
| gem "standard-performance" | ||
| gem "simplecov", "~> 0.22.0" | ||
| gem "simplecov-cobertura", "~> 3.0" | ||
| gem "timecop", "~> 0.9.10" | ||
| end | ||
|
|
||
| group :test do | ||
| gem "cucumber", "~> 10.0" | ||
| gem "logger" | ||
| end |
There was a problem hiding this comment.
For consistency and to reduce redundancy, the gems in the separate :test group can be merged into the :development, :test group. This keeps all development and test-related dependencies consolidated in a single block, improving the Gemfile's readability and maintainability.
group :development, :test do
gem "debug"
gem "markly"
gem "rake", "~> 13.0"
gem "rspec", "~> 3.12.0"
gem "standard"
gem "standard-performance"
gem "simplecov", "~> 0.22.0"
gem "simplecov-cobertura", "~> 3.0"
gem "timecop", "~> 0.9.10"
gem "cucumber", "~> 10.0"
gem "logger"
end
There was a problem hiding this comment.
Keeping the groups separate is intentional — cucumber and logger are test-only dependencies that aren't needed during development. This is a common Ruby convention for gems that have distinct test harnesses (Cucumber for conformance tests) separate from the development workflow.
🤖 Jose's AI agent
Prevents thread-local context leakage in multi-threaded servers like Puma by clearing the transaction context after each request. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Signed-off-by: Jose Colella <jose.colella@gusto.com>
- Add comment explaining trivial method implementations in custom_provider example - Standardize Ruby version pinning to "3.4" across all CI jobs - Use bundle lock instead of bundle install in security audit job Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Signed-off-by: Jose Colella <jose.colella@gusto.com>
1 participant
Summary
Brings the Ruby SDK repository up to parity with sibling OpenFeature SDKs (Go, Java, .NET) and Ruby community standards based on a comparative analysis.
Gemspec Fixes (High Priority)
openfeature-rubyto correctruby-sdk— RubyGems links were brokenrubygems_mfa_requiredmetadata (modern security best practice)README Improvements (High Priority)
CONTRIBUTING.md Fixes (Medium Priority)
CI/CD Improvements (Medium Priority)
headto matrix withcontinue-on-errorfor early breakage detectionbundler-auditsecurity scanning jobNew Repository Files (Medium Priority)
SECURITY.md— CNCF/CII best practice for vulnerability reporting.yardopts+ YARD Rake task — enables API documentation generationexamples/directory — basic_usage.rb, custom_provider.rb, rails_integration.rbMinor Improvements (Low Priority)
minimum_coverage 90to SimpleCovGemfile.lockto.gitignore(gem convention)Verification
bundle exec rspecbundle exec standardrbgem build openfeature-sdk.gemspecgem specificationmetadataruby-sdkTest plan
🤖 Jose's AI agent