Merge pull request #635 from ruby/fix-nightly-js-gem-checksum-20260402

packaging: allow local js gem installs in nightly npm builds

Author: kateinoigakukun

.github/workflows/build-gems.yml

@@ -46,11 +46,33 @@ jobs:
         with:
           ruby-version: "3.4"
 
-      - uses: oxidize-rb/actions/cross-gem@v1
+      - name: Detect rb-sys version from Cargo.lock
+        id: rb-sys
+        run: |
+          version="$(awk '/name = "rb-sys"/{flag=1; next} flag && /version = / {gsub(/"/, "", $3); print $3; exit}' Cargo.lock)"
+          if [ -z "$version" ]; then
+            echo "Failed to detect rb-sys version from Cargo.lock" >&2
+            exit 1
+          fi
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+
+      - name: Build native gem with rb-sys-dock
         id: cross-gem
-        with:
-          platform: ${{ matrix.ruby-platform }}
-          ruby-versions: ${{ join(fromJSON(needs.ci-data.outputs.result).stable-ruby-versions, ',') }}
+        env:
+          PLATFORM: ${{ matrix.ruby-platform }}
+          RUBY_VERSIONS: ${{ join(fromJSON(needs.ci-data.outputs.result).stable-ruby-versions, ',') }}
+          RB_SYS_VERSION: ${{ steps.rb-sys.outputs.version }}
+        run: |
+          gem install rb_sys -v "$RB_SYS_VERSION"
+          rb-sys-dock --platform "$PLATFORM" --directory . --ruby-versions "$RUBY_VERSIONS" --tag "$RB_SYS_VERSION" --build
+
+          gem_path="$(find ./pkg -name "*-${PLATFORM}.gem" | head -n1)"
+          if [ -z "$gem_path" ]; then
+            echo "Failed to find built gem for ${PLATFORM}" >&2
+            ls -la ./pkg || true
+            exit 1
+          fi
+          echo "gem-path=$gem_path" >> "$GITHUB_OUTPUT"
 
       - uses: actions/upload-artifact@v7
         with:

rakelib/packaging.rake

@@ -62,6 +62,9 @@ def build_ruby(pkg, base_dir, pkg_dir, binaryen, clean: false)
     # Share ./build and ./rubies in the same workspace
     "RUBY_WASM_ROOT" => base_dir
   }
+  # We vendor a freshly built js gem in package workspaces. Bundler checksum
+  # validation against rubygems.org can fail for the same version.
+  env["BUNDLE_DISABLE_CHECKSUM_VALIDATION"] = "true" if pkg[:gemfile]
   cwd = base_dir
   if gemfile_path = pkg[:gemfile]
     cwd = File.dirname(gemfile_path)
@@ -94,8 +97,10 @@ def build_ruby(pkg, base_dir, pkg_dir, binaryen, clean: false)
       Dir.chdir(cwd) do
         # uninstall js gem to re-install just-built js gem
         sh "gem", "uninstall", "js", "-v", js_gem_version, "--force"
-        # install gems including js gem
-        sh "bundle", "install"
+        # install gems including js gem. Bundler may compare checksums with
+        # rubygems.org for the same version and reject our just-built local gem.
+        # Disable checksum validation only for this install command.
+        sh({ "BUNDLE_DISABLE_CHECKSUM_VALIDATION" => "true" }, "bundle", "install")
 
         sh env,
            "bundle", "exec",