Severity: low · Area: ci
Where: .github/workflows/ci.yml:52-56, release.yml:126-180.
Everything compiles the working tree in place (rake compile); nothing ever does
gem install pkg/*.gem. So the gemspec spec.files glob (microsandbox-rb.gemspec:42-53) and
the from-gem source-compile path are never exercised end-to-end. The gem packs the root
Cargo.lock/Cargo.toml but the build compiles ext/microsandbox/ — exactly the kind of
pathing detail an in-tree compile can't validate.
Impact: A packaging regression (omitted source file, missing Cargo.lock/rust-toolchain.toml,
renamed path) reaches RubyGems and breaks gem install microsandbox-rb (the default install for
every non-fat-gem platform) with no pre-publish signal.
Fix: Add a CI job that runs rake build, gem install pkg/*.gem into a clean prefix, and
ruby -e 'require "microsandbox"; Microsandbox.version' (with a Rust toolchain present).
Filed from a cross-repo audit of microsandbox-rb 0.8.1 against upstream microsandbox v0.5.10; each finding was adversarially verified against source in both repos.
Severity: low · Area: ci
Where:
.github/workflows/ci.yml:52-56,release.yml:126-180.Everything compiles the working tree in place (
rake compile); nothing ever doesgem install pkg/*.gem. So the gemspecspec.filesglob (microsandbox-rb.gemspec:42-53) andthe from-gem source-compile path are never exercised end-to-end. The gem packs the root
Cargo.lock/Cargo.tomlbut the build compilesext/microsandbox/— exactly the kind ofpathing detail an in-tree compile can't validate.
Impact: A packaging regression (omitted source file, missing
Cargo.lock/rust-toolchain.toml,renamed path) reaches RubyGems and breaks
gem install microsandbox-rb(the default install forevery non-fat-gem platform) with no pre-publish signal.
Fix: Add a CI job that runs
rake build,gem install pkg/*.geminto a clean prefix, andruby -e 'require "microsandbox"; Microsandbox.version'(with a Rust toolchain present).Filed from a cross-repo audit of
microsandbox-rb0.8.1 against upstreammicrosandboxv0.5.10; each finding was adversarially verified against source in both repos.