From 3b738124415674fc8bc1f3c480a756097d6d4569 Mon Sep 17 00:00:00 2001
From: Grant Hutchins <git@nertzy.com>
Date: Fri, 22 May 2026 15:04:20 -0500
Subject: [PATCH 1/4] Drop bundle update step from CI matrix

Previously the matrix prepended ACTIVE_RECORD_VERSION (or
ACTIVE_RECORD_BRANCH) onto a separate `bundle update` step because
setup-ruby's bundler-cache install ran before those env vars were in
scope. The cached install resolved the gemspec's default ActiveRecord,
so a follow-up `bundle update` was needed to swap in the matrix's
chosen version.

Write the matrix's KEY=value to $GITHUB_ENV in a step that runs before
setup-ruby instead. The cached install now resolves the right gems on
the first try, and cache-version partitions the bundler cache per
matrix entry so different ActiveRecord versions don't collide.
---
 .github/workflows/ci.yml | 27 +++++++++++++++------------
 1 file changed, 15 insertions(+), 12 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 2952dca2..5efbd540 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -37,40 +37,43 @@ jobs:
       fail-fast: false
       matrix:
         ruby-version: ["3.3", "3.4", "4.0"]
-        active-record-version-env:
-          - ACTIVE_RECORD_VERSION="~> 7.2.0"
-          - ACTIVE_RECORD_VERSION="~> 8.0.0"
-          - ACTIVE_RECORD_VERSION="~> 8.1.0"
+        active-record-env:
+          - "ACTIVE_RECORD_VERSION=~> 7.2.0"
+          - "ACTIVE_RECORD_VERSION=~> 8.0.0"
+          - "ACTIVE_RECORD_VERSION=~> 8.1.0"
         allow-failure: [false]
         include:
           - ruby-version: "ruby-head"
-            active-record-version-env: ACTIVE_RECORD_VERSION="~> 8.1.0"
+            active-record-env: "ACTIVE_RECORD_VERSION=~> 8.1.0"
             allow-failure: true
           - ruby-version: "4.0"
-            active-record-version-env: ACTIVE_RECORD_BRANCH="main"
+            active-record-env: "ACTIVE_RECORD_BRANCH=main"
             allow-failure: true
           - ruby-version: "4.0"
-            active-record-version-env: ACTIVE_RECORD_BRANCH="8-1-stable"
+            active-record-env: "ACTIVE_RECORD_BRANCH=8-1-stable"
             allow-failure: true
           - ruby-version: "4.0"
-            active-record-version-env: ACTIVE_RECORD_BRANCH="8-0-stable"
+            active-record-env: "ACTIVE_RECORD_BRANCH=8-0-stable"
             allow-failure: true
           - ruby-version: "4.0"
-            active-record-version-env: ACTIVE_RECORD_BRANCH="7-2-stable"
+            active-record-env: "ACTIVE_RECORD_BRANCH=7-2-stable"
             allow-failure: true
     continue-on-error: ${{ matrix.allow-failure }}
     steps:
       - uses: actions/checkout@v6
+      - name: Select ActiveRecord version
+        env:
+          ACTIVE_RECORD_ENV: ${{ matrix.active-record-env }}
+        run: echo "$ACTIVE_RECORD_ENV" >> "$GITHUB_ENV"
       - name: Set up Ruby
         uses: ruby/setup-ruby@v1
         with:
           ruby-version: ${{ matrix.ruby-version }}
           bundler-cache: true
+          cache-version: ${{ matrix.active-record-env }}
       - name: Set up test database
         env:
           PGPASSWORD: postgres
         run: createdb pg_search_test
-      - name: Update bundle
-        run: ${{ matrix.active-record-version-env }} bundle update
       - name: Run tests
-        run: ${{ matrix.active-record-version-env }} bundle exec rake
+        run: bundle exec rake

From 6d3fbedcf2dcb843c4121c16b399e1f447094349 Mon Sep 17 00:00:00 2001
From: Grant Hutchins <git@nertzy.com>
Date: Fri, 22 May 2026 15:07:01 -0500
Subject: [PATCH 2/4] Give CI matrix jobs readable names
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

GitHub renders matrix job names from raw axis values by default, so
runs showed up as `test (3.3, ACTIVE_RECORD_VERSION=~> 7.2.0, false)`
— readable only after squinting.

Group the ActiveRecord axis into an object with a short `label` and a
`env` payload, then set the job `name:` to
`Ruby <ruby-version> / <label>`. Runs now show up as e.g.
`Ruby 3.3 / AR 7.2` or `Ruby 4.0 / AR main`.
---
 .github/workflows/ci.yml | 27 ++++++++++++++-------------
 1 file changed, 14 insertions(+), 13 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 5efbd540..75e9cbcd 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -14,6 +14,7 @@ on:
 
 jobs:
   test:
+    name: Ruby ${{ matrix.ruby-version }} / Active Record ${{ matrix.active-record.label }}
     runs-on: ubuntu-latest
     services:
       postgres:
@@ -37,40 +38,40 @@ jobs:
       fail-fast: false
       matrix:
         ruby-version: ["3.3", "3.4", "4.0"]
-        active-record-env:
-          - "ACTIVE_RECORD_VERSION=~> 7.2.0"
-          - "ACTIVE_RECORD_VERSION=~> 8.0.0"
-          - "ACTIVE_RECORD_VERSION=~> 8.1.0"
+        active-record:
+          - { label: "7.2", env: "ACTIVE_RECORD_VERSION=~> 7.2.0" }
+          - { label: "8.0", env: "ACTIVE_RECORD_VERSION=~> 8.0.0" }
+          - { label: "8.1", env: "ACTIVE_RECORD_VERSION=~> 8.1.0" }
         allow-failure: [false]
         include:
-          - ruby-version: "ruby-head"
-            active-record-env: "ACTIVE_RECORD_VERSION=~> 8.1.0"
-            allow-failure: true
           - ruby-version: "4.0"
-            active-record-env: "ACTIVE_RECORD_BRANCH=main"
+            active-record: { label: "main", env: "ACTIVE_RECORD_BRANCH=main" }
             allow-failure: true
           - ruby-version: "4.0"
-            active-record-env: "ACTIVE_RECORD_BRANCH=8-1-stable"
+            active-record: { label: "8-1-stable", env: "ACTIVE_RECORD_BRANCH=8-1-stable" }
             allow-failure: true
           - ruby-version: "4.0"
-            active-record-env: "ACTIVE_RECORD_BRANCH=8-0-stable"
+            active-record: { label: "8-0-stable", env: "ACTIVE_RECORD_BRANCH=8-0-stable" }
             allow-failure: true
           - ruby-version: "4.0"
-            active-record-env: "ACTIVE_RECORD_BRANCH=7-2-stable"
+            active-record: { label: "7-2-stable", env: "ACTIVE_RECORD_BRANCH=7-2-stable" }
+            allow-failure: true
+          - ruby-version: "ruby-head"
+            active-record: { label: "8.1", env: "ACTIVE_RECORD_VERSION=~> 8.1.0" }
             allow-failure: true
     continue-on-error: ${{ matrix.allow-failure }}
     steps:
       - uses: actions/checkout@v6
       - name: Select ActiveRecord version
         env:
-          ACTIVE_RECORD_ENV: ${{ matrix.active-record-env }}
+          ACTIVE_RECORD_ENV: ${{ matrix.active-record.env }}
         run: echo "$ACTIVE_RECORD_ENV" >> "$GITHUB_ENV"
       - name: Set up Ruby
         uses: ruby/setup-ruby@v1
         with:
           ruby-version: ${{ matrix.ruby-version }}
           bundler-cache: true
-          cache-version: ${{ matrix.active-record-env }}
+          cache-version: ${{ matrix.active-record.env }}
       - name: Set up test database
         env:
           PGPASSWORD: postgres

From e88ab5ae36c68a4ddafb3d89174d4e2fc7114d1a Mon Sep 17 00:00:00 2001
From: Grant Hutchins <git@nertzy.com>
Date: Fri, 22 May 2026 15:15:57 -0500
Subject: [PATCH 3/4] Drop dead PGPASS env from CI workflow

PGPASS is not a libpq variable (the correct name is PGPASSWORD) and
nothing in the repo reads it. The actual password is supplied by
PGPASSWORD on the createdb step and by a hardcoded "postgres" in
spec/support/database.rb when CI=true. Removing the line so the job
env block accurately reflects what's in use.
---
 .github/workflows/ci.yml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 75e9cbcd..227f5666 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -33,7 +33,6 @@ jobs:
       CI: true
       PGHOST: 127.0.0.1
       PGUSER: postgres
-      PGPASS: postgres
     strategy:
       fail-fast: false
       matrix:

From 39f9a666f7b9820b031abfb051b79c0f8b4875cc Mon Sep 17 00:00:00 2001
From: Grant Hutchins <git@nertzy.com>
Date: Fri, 22 May 2026 15:19:42 -0500
Subject: [PATCH 4/4] Tighten CI workflow defaults

Three defensive additions to .github/workflows/ci.yml:

- `permissions: contents: read` at the workflow level. Nothing in the
  workflow needs write access to the repo, and least-privilege defaults
  shrink the blast radius if any action ever turns out to be hostile.

- A `concurrency` group keyed on the workflow and ref, cancelling
  in-progress runs only when triggered by a pull request. Stacked PR
  pushes no longer waste CI minutes on superseded matrices; pushes to
  master and the Saturday cron still run to completion.

- `timeout-minutes: 20` on the test job. The suite finishes in well
  under that locally; the timeout guards against a hung runner (most
  likely on the ruby-head row) eating the GH Actions budget for six
  hours.
---
 .github/workflows/ci.yml | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 227f5666..882b32fa 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -12,10 +12,18 @@ on:
     - cron: "0 18 * * 6" # Saturdays at 12pm CST
   workflow_dispatch:
 
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   test:
     name: Ruby ${{ matrix.ruby-version }} / Active Record ${{ matrix.active-record.label }}
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     services:
       postgres:
         image: postgres:latest