From a6501082d060c5e57099b9ec4482e8af8d48cfa3 Mon Sep 17 00:00:00 2001 From: Maqsood Ahmad Date: Wed, 14 Oct 2026 20:32:26 +0530 Subject: [PATCH 1/2] (MODULES-11972) Always install libcurl dev headers in module_ci puppet_litmus -> bolt -> faraday-patron pulls in patron, whose native extension needs libcurl headers the runner image doesn't ship. The Ruby 4 spec lane fails in bundle install without them, which skips Acceptance (e.g. iis, facter_task nightlies). Several modules already work around this with additional_packages: "libcurl4-openssl-dev"; since the cause is litmus and not module-specific, install it by default on Linux runners. additional_packages still appends extra packages. Co-Authored-By: Claude --- .github/workflows/module_ci.yml | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) diff --git a/.github/workflows/module_ci.yml b/.github/workflows/module_ci.yml index 0c45118..8ef1ab3 100644 --- a/.github/workflows/module_ci.yml +++ b/.github/workflows/module_ci.yml @@ -25,7 +25,7 @@ on: default: '3.2' type: "string" additional_packages: - description: "Space-separated list of OS packages to install on the runner (apt-get)" + description: "Space-separated list of extra OS packages to install on the runner (apt-get), in addition to libcurl4-openssl-dev" required: false default: '' type: "string" @@ -60,13 +60,16 @@ jobs: persist-credentials: false - name: "Install additional packages" - if: ${{ inputs.additional_packages != '' }} + if: runner.os == 'Linux' + # libcurl4-openssl-dev is always installed: puppet_litmus -> bolt -> faraday-patron + # pulls in patron, whose native extension needs libcurl headers the runner image + # doesn't ship (fails bundle install on the Ruby 4 lane). # Refresh the package index first: the runner image's baked-in apt lists can lag # behind the live archive, so installing straight away can 404 on a package whose # exact cached version has since been superseded and evicted from the mirror pool. run: | sudo apt-get update - sudo apt-get install -y ${{ inputs.additional_packages }} + sudo apt-get install -y libcurl4-openssl-dev ${{ inputs.additional_packages }} - name: "Configure forge authentication" env: @@ -121,13 +124,16 @@ jobs: persist-credentials: false - name: "Install additional packages" - if: ${{ inputs.additional_packages != '' }} + if: runner.os == 'Linux' + # libcurl4-openssl-dev is always installed: puppet_litmus -> bolt -> faraday-patron + # pulls in patron, whose native extension needs libcurl headers the runner image + # doesn't ship (fails bundle install on the Ruby 4 lane). # Refresh the package index first: the runner image's baked-in apt lists can lag # behind the live archive, so installing straight away can 404 on a package whose # exact cached version has since been superseded and evicted from the mirror pool. run: | sudo apt-get update - sudo apt-get install -y ${{ inputs.additional_packages }} + sudo apt-get install -y libcurl4-openssl-dev ${{ inputs.additional_packages }} - name: "Configure forge authentication" env: From 9c102f9bb9a9119c94ddd5522e3d8f9d660bad33 Mon Sep 17 00:00:00 2001 From: Maqsood Ahmad Date: Wed, 14 Oct 2026 23:07:31 +0530 Subject: [PATCH 2/2] (MODULES-11972) Correct the patron dependency chain in module_ci comments The previous comment (and commit message) said bolt pulls in faraday-patron directly, which is wrong. Reproduced with `bundle lock` on Ruby 4.0.1 vs 3.2.10: - faraday-follow_redirects <= 0.4.0 declares required_ruby_version < 4, and puppet_forge 4.x-6.0.x pin it to ~> 0.3.0, so on Ruby 4 bundler cannot use them (puppet_forge 6.1+ needs minitar ~> 1.0, which conflicts with bolt's minitar ~> 0.6, and r10k 4.x caps puppet_forge < 6). - Bundler therefore falls back to bolt -> r10k 3.16.2 -> puppet_forge 3.2.0 -> faraday ~> 1.3 (1.9.0). faraday 1.x depends on its adapter gems, including faraday-patron (< 3) -> patron. - On Ruby 3.2 the same Gemfile resolves r10k 4.1.0 / puppet_forge 5.0.4 / faraday 2.14.4 and no patron. Co-Authored-By: Claude --- .github/workflows/module_ci.yml | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/.github/workflows/module_ci.yml b/.github/workflows/module_ci.yml index 8ef1ab3..9468a5c 100644 --- a/.github/workflows/module_ci.yml +++ b/.github/workflows/module_ci.yml @@ -61,9 +61,10 @@ jobs: - name: "Install additional packages" if: runner.os == 'Linux' - # libcurl4-openssl-dev is always installed: puppet_litmus -> bolt -> faraday-patron - # pulls in patron, whose native extension needs libcurl headers the runner image - # doesn't ship (fails bundle install on the Ruby 4 lane). + # libcurl4-openssl-dev is always installed for the Ruby 4 lane: faraday-follow_redirects + # <= 0.4 requires ruby < 4, so bundler can't use puppet_forge 4.x-6.0.x there and falls + # back to r10k 3.x -> puppet_forge 3.2 -> faraday 1.x. faraday 1.x depends on its adapter + # gems, including faraday-patron -> patron, a native extension that needs libcurl headers. # Refresh the package index first: the runner image's baked-in apt lists can lag # behind the live archive, so installing straight away can 404 on a package whose # exact cached version has since been superseded and evicted from the mirror pool. @@ -125,9 +126,10 @@ jobs: - name: "Install additional packages" if: runner.os == 'Linux' - # libcurl4-openssl-dev is always installed: puppet_litmus -> bolt -> faraday-patron - # pulls in patron, whose native extension needs libcurl headers the runner image - # doesn't ship (fails bundle install on the Ruby 4 lane). + # libcurl4-openssl-dev is always installed for the Ruby 4 lane: faraday-follow_redirects + # <= 0.4 requires ruby < 4, so bundler can't use puppet_forge 4.x-6.0.x there and falls + # back to r10k 3.x -> puppet_forge 3.2 -> faraday 1.x. faraday 1.x depends on its adapter + # gems, including faraday-patron -> patron, a native extension that needs libcurl headers. # Refresh the package index first: the runner image's baked-in apt lists can lag # behind the live archive, so installing straight away can 404 on a package whose # exact cached version has since been superseded and evicted from the mirror pool.