Fix CI, test through Ruby 4.0, and pin actions by SHA

[tas50]

Every job on the Unit Tests workflow was failing before running a single spec (before). This gets the whole matrix green and extends it through Ruby 4.0.

1. Both install steps were broken

docker-rspec — the ubuntu-24.04 runner image now preinstalls a docker-ce newer than the 26.x/27.x versions pinned in the matrix, so installing the pin is a downgrade:

The following packages will be DOWNGRADED: docker-ce
E: Packages were downgraded and -y was used without --allow-downgrades.

Fixed by passing --allow-downgrades.

The existing Could not install diagnostic was also unreachable — the step runs under bash -e, so it exited at the failing apt-get before the if [ $? -ne 0 ] was evaluated, which is why runs showed the raw apt error and never the intended message. Replaced with a check that apt-cache madison actually matched a version.

podman-rspec — script/install_podman.sh pulled podman from the openSUSE Build Service repo devel:kubic:libcontainers:stable. That project was retired and Release.key now serves an HTML error page instead of a signing key:

<title>Resource is no longer available!</title>
gpg: no valid OpenPGP data found.

Ubuntu ships podman in universe (4.9.3+ds1-1ubuntu0.1 on 24.04), so the third-party repo is dropped entirely.

2. Spec failures the install fixes exposed

All twelve Ruby 3.x jobs failed on its(:resource) with private method 'resource' called. #resource is deliberately private, and rspec-its dispatches with public_send on Ruby 3.0+. Every 2.x job passed and every 3.x job failed, so this was the single systematic cause. Now called with send from a plain example.

A race in the Container#stop spec. POST /containers/{id}/stop returns once the daemon has signalled the container, which can land just before it leaves the running list, so listing running containers immediately afterwards is a race. It now waits on the not-running condition first — Container#wait is already the synchronisation primitive used elsewhere in that file, and the wait endpoint defaults to exactly the condition the assertion checks.

3. Ruby 3.4 and 4.0

base64 stopped being a default gem in Ruby 3.4, so require 'base64' in lib/docker.rb raises LoadError under Bundler. The gem is currently unusable on Ruby 3.4+ — this is a real user-facing bug, not just a CI one:

cannot load such file -- base64 (LoadError)
  from lib/docker.rb:7:in '<top (required)>'

Declared base64 as a runtime dependency. On older rubies it resolves to the default gem, so nothing changes there. Ruby 3.4 and 4.0 are added to both matrices and pass.

4. Supply chain

• actions/checkout and ruby/setup-ruby are pinned to commit SHAs rather than mutable tags, updated to their latest releases (v4 → v7.0.1, v1 → v1.321.0). The checkout bump also clears the Node 20 deprecation warning.
• apt-key replaced with a signed-by keyring for the Docker repo. apt-key is deprecated, warned on every run, and is slated for removal — it would have broken this workflow a second time. This also clears the Key is stored in legacy trusted.gpg keyring warning.
• Added .github/dependabot.yml so the pinned SHAs still get updated, with a 7 day cooldown so a compromised release is not picked up the moment it is published.

Result

All 30 jobs green — Ruby 2.4 through 4.0, against Docker 26 and 27, plus podman.