Fix CI, test through Ruby 4.0, and pin actions by SHA

.github/dependabot.yml

@@ -0,0 +1,16 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    # Wait a week before proposing a newly published action version, so a
+    # compromised release has time to be caught and pulled.
+    cooldown:
+      default-days: 7
+    commit-message:
+      prefix: "ci"
+    groups:
+      github-actions:
+        patterns:
+          - "*"

.github/workflows/unit_test.yml

@@ -15,6 +15,8 @@ jobs:
     strategy:
       matrix:
         ruby:
+          - '4.0'
+          - 3.4
           - 3.3
           - 3.2
           - 3.1
@@ -28,8 +30,8 @@ jobs:
           - ':27.'
       fail-fast: false
     steps:
-      - uses: actions/checkout@v4
-      - uses: ruby/setup-ruby@v1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
         with:
           ruby-version: ${{ matrix.ruby }}
           bundler-cache: true
@@ -42,19 +44,26 @@ jobs:
           set -x
           sudo apt-get remove -y docker docker-engine docker.io containerd runc ||:
           sudo apt-get update -y
-          sudo apt-get install -y apt-transport-https ca-certificates curl gnupg-agent software-properties-common
-          curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo apt-key add -
-          sudo add-apt-repository "deb [arch=amd64] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable"
+          sudo apt-get install -y apt-transport-https ca-certificates curl gnupg
+          # apt-key is deprecated and slated for removal; use a keyring instead.
+          sudo install -m 0755 -d /etc/apt/keyrings
+          curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo tee /etc/apt/keyrings/docker.asc > /dev/null
+          sudo chmod a+r /etc/apt/keyrings/docker.asc
+          echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
           sudo apt-get update -y
           sudo apt-cache gencaches
-          sudo apt-get install -y docker-ce=$( apt-cache madison docker-ce | grep -e $DOCKER_VERSION | cut -f 2 -d '|' | head -1 | sed 's/\s//g' )
-          if [ $? -ne 0 ]; then
-            echo "Error: Could not install ${DOCKER_VERSION}"
+          version=$( apt-cache madison docker-ce | grep -e "$DOCKER_VERSION" | cut -f 2 -d '|' | head -1 | sed 's/\s//g' )
+          if [ -z "$version" ]; then
+            echo "Error: Could not find a docker-ce package matching ${DOCKER_VERSION}"
             echo "Available docker versions:"
             apt-cache madison docker-ce
             exit 1
           fi
+          # The runner image preinstalls a newer docker-ce than the versions
+          # pinned in the matrix, so installing the pin is a downgrade.
+          sudo apt-get install -y --allow-downgrades docker-ce="$version"
           sudo systemctl start docker
+          docker version
       - name: spec tests
         run: bundle exec rake
 
@@ -64,6 +73,8 @@ jobs:
     strategy:
       matrix:
         ruby:
+          - '4.0'
+          - 3.4
           - 3.3
           - 3.2
           - 3.1
@@ -74,8 +85,8 @@ jobs:
           - 2.4
       fail-fast: false
     steps:
-      - uses: actions/checkout@v4
-      - uses: ruby/setup-ruby@v1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
         with:
           ruby-version: ${{ matrix.ruby }}
           bundler-cache: true

docker-api.gemspec

@@ -14,6 +14,9 @@ Gem::Specification.new do |gem|
   gem.version       = Docker::VERSION
   gem.add_dependency 'excon', '>= 0.64.0'
   gem.add_dependency 'multi_json'
+  # base64 stopped being a default gem in Ruby 3.4, so `require 'base64'` in
+  # lib/docker.rb raises LoadError under Bundler unless it is declared.
+  gem.add_dependency 'base64'
   gem.add_development_dependency 'rake'
   gem.add_development_dependency 'rspec', '~> 3.0'
   gem.add_development_dependency 'rspec-its'

script/install_podman.sh

@@ -1,12 +1,16 @@
 #!/bin/sh
 set -ex
 
-. /etc/os-release
-
-curl -L https://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable/xUbuntu_${VERSION_ID}/Release.key | sudo apt-key add -
-
-echo "deb https://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable/xUbuntu_${VERSION_ID}/ /" > /etc/apt/sources.list.d/podman.list
+# Ubuntu ships podman in the universe repository (4.9.3 on 24.04), so no
+# third-party repository is required.
+#
+# This previously pulled podman from the openSUSE Build Service repo
+# devel:kubic:libcontainers:stable. That project was retired and the repo now
+# serves an HTML "Resource is no longer available!" page in place of
+# Release.key, so `apt-key add` failed with "no valid OpenPGP data found".
 
 apt-get update
 
 apt-get install -y podman
+
+podman --version

spec/docker/connection_spec.rb

@@ -66,7 +66,11 @@
   end
 
   describe '#resource' do
-    its(:resource) { should be_a Excon::Connection }
+    # #resource is private, so it cannot go through `its`, which uses
+    # public_send on Ruby 3.0+.
+    it 'is an Excon::Connection' do
+      expect(subject.send(:resource)).to be_a Excon::Connection
+    end
   end
 
   describe '#request' do

spec/docker/container_spec.rb

@@ -503,7 +503,14 @@
       described_class.create('Cmd' => %w[true], 'Image' => 'debian:stable')
     }
 
-    before { subject.tap(&:start).stop('timeout' => '10') }
+    # POST /containers/{id}/stop returns once the daemon has signalled the
+    # container, which can land just before it leaves the running list. Wait on
+    # the not-running condition so the assertion below is not racing that
+    # transition.
+    before do
+      subject.tap(&:start).stop('timeout' => '10')
+      subject.wait(10)
+    end
     after { subject.remove }
 
     it 'stops the container' do