Skip to content

AP-588 Upgrade Rails to 8.0.x#20

Open
steve-sullivan wants to merge 9 commits intomainfrom
AP-588-upgrade-dependencies
Open

AP-588 Upgrade Rails to 8.0.x#20
steve-sullivan wants to merge 9 commits intomainfrom
AP-588-upgrade-dependencies

Conversation

@steve-sullivan
Copy link

Upgrade Rails and dependencies to 8.0.x

  • Upgrade Rails to 8.0.5
  • Upgrade omniauth-cas to 3.x and add CSRF protection
  • Update Puma, RSpec, RuboCop, and Berkeley Library gems
  • Fix Rails 8 changes (ActiveRecord connection pool, status codes)
  • Update auth for OmniAuth 2
  • Fix CI (db task + secret_key_base requirement)

Copy link
Member

@anarchivist anarchivist left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

generally looks good - rw+c. most of my comments are minor. you might want to ask Anna to look at this, too.

Gemfile.lock Outdated

BUNDLED WITH
2.5.22
2.5.3
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

can we make sure we're using a more recent version of bundler here? it certainly should be no older than 2.5.22

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Strange. 2.5.22 specified in the docker file..., I'm not sure how the lock file got downgraded. I'll try to bump this to the same bundler version we're using for Framework I guess... 2.7.2

@steve-sullivan steve-sullivan requested a review from awilfox March 26, 2026 23:22
Copy link
Member

@awilfox awilfox left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This looks mostly good, just a few nits. However, it looks like rails app:update wasn't run, similar to what happened at the beginning of BerkeleyLibrary/UCBEARS#21. Can you make sure that's run and the configuration files are updated appropriately? I described how to do that in the UCBEARS MR.

Comment on lines +9 to 10
ActiveRecord::Base.connection_pool.with_connection(&:active?)
rescue PG::ConnectionBad
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

When we upgraded Framework to 8.0, the suggested way to do it was to use verify! on the connection object. We also needed to add ActiveRecord::DatabaseConnectionError to the rescue block, but I'm not sure if that's because of verify! or because in general Rails 8 can raise that.

Suggested change
ActiveRecord::Base.connection_pool.with_connection(&:active?)
rescue PG::ConnectionBad
ActiveRecord::Base.connection.verify!
rescue PG::ConnectionBad, ActiveRecord::DatabaseConnectionError

I don't mind doing it the way already here; I just haven't seen it before. (will this raise if there are no active connections, or just return nil?)


RUBY VERSION
ruby 3.3.9p170
ruby 3.3.9p170
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should we be moving this to 3.3.11 as well?

gem 'rack-cors'
gem 'rails', '~> 7.0.4'
gem 'ransack', '~> 2.6'
gem 'rails', '~> 8.0.4'
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

They've already snuck out another release while this was being worked on!

Suggested change
gem 'rails', '~> 8.0.4'
gem 'rails', '~> 8.0.5'

- name: Validate database migrations
env:
RAILS_ENV: production
SECRET_KEY_BASE: dummy
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do we want to test the Rails secrets stuff here like we do in Framework?

See BerkeleyLibrary/framework@6cf75564ef, specifically .github/workflows/build.yml and docker-compose.ci.yml. This makes a "real" (throwaway) secret, and that ensures the app is going to read it from the correct place in production.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants