From 527fc63972f33c71a0aa38c2d15c3a0ed16a490d Mon Sep 17 00:00:00 2001
From: Ryan Duguid <152749594+ryanduguid@users.noreply.github.com>
Date: Thu, 13 Aug 2026 02:36:25 +1000
Subject: [PATCH 1/2] ci: test the Ruby event source

---
 .github/workflows/build-test-lint.yml | 79 +++++++++++++++------------
 1 file changed, 43 insertions(+), 36 deletions(-)

diff --git a/.github/workflows/build-test-lint.yml b/.github/workflows/build-test-lint.yml
index 98c47e35..7d793ad1 100644
--- a/.github/workflows/build-test-lint.yml
+++ b/.github/workflows/build-test-lint.yml
@@ -1,41 +1,48 @@
 name: Ruby Build, Lint and Test
 
 on:
-    push:
-        branches:
-          - master
-    pull_request:
-        types: [opened, reopened, synchronize]
+  push:
+    branches: [master]
+  pull_request:
+    types: [opened, reopened, synchronize]
+
+permissions:
+  contents: read
 
 jobs:
-    build-test-lint:
-        runs-on: ubuntu-latest
-
-        steps:
-            - name: Checkout xero-ruby repo
-              uses: actions/checkout@v4
-              with:
-                repository: XeroAPI/xero-ruby
-                path: xero-ruby
-
-            - name: Set up Ruby environment
-              uses: ruby/setup-ruby@v1
-              with: 
-                ruby-version: '3.2.0'
-                bundler-cache: true
-
-            - name: Install dependencies
-              run: bundle install
-              working-directory: xero-ruby
-
-            - name: Compile Build
-              run: find . -name "*.rb" | xargs -n 1 ruby -c > /dev/null 2>&1 || exit 1
-              working-directory: xero-ruby
-
-            - name: Lint Code
-              run: bundle exec rubocop
-              working-directory: xero-ruby
-
-            - name: Run Tests
-              run: bundle exec rake spec
-              working-directory: xero-ruby
\ No newline at end of file
+  build-test-lint:
+    name: Ruby ${{ matrix.ruby }} on ${{ matrix.os }}
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 20
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-latest
+            ruby: "3.2"
+          - os: ubuntu-latest
+            ruby: "3.4"
+          - os: windows-latest
+            ruby: "3.2"
+
+    steps:
+      - name: Check out event source
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.2.2
+
+      - name: Set up Ruby
+        uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
+        with:
+          ruby-version: ${{ matrix.ruby }}
+          bundler-cache: true
+
+      - name: Compile source
+        run: bundle exec ruby -e 'Dir["{lib,spec}/**/*.rb"].each { |file| RubyVM::InstructionSequence.compile_file(file) }'
+
+      - name: Lint
+        run: bundle exec rubocop
+
+      - name: Test
+        run: bundle exec rake spec
+
+      - name: Build gem
+        run: bundle exec gem build xero-ruby.gemspec

From 3c6eb13f914e844281c8383290b9ad24ddb092df Mon Sep 17 00:00:00 2001
From: Ryan Duguid <152749594+ryanduguid@users.noreply.github.com>
Date: Wed, 19 Aug 2026 15:11:53 +1000
Subject: [PATCH 2/2] ci: correct the actions/checkout version comment and flag
 the Ruby floor gap

The pin comment claimed v4.2.2, but 11d5960a326750d5838078e36cf38b85af677262 is
tag v4.4.0. Verified with `gh api repos/actions/checkout/git/ref/tags/v4.2.2`,
which resolves to 11bd71901bbe5b1630ceea73d27597364c9af683, and with
`gh api repos/actions/checkout/commits/11d5960a...`, which is the v4.4.0
"backport fixes to releases-v4" commit dated 2026-07-16.

Corrected the comment rather than repinning to v4.2.2: the pinned SHA is the
newer release, so repinning down would drop roughly 21 months of fixes to keep a
stale comment true. The ruby/setup-ruby pin was checked the same way and its
v1.321.0 comment is correct.

Also recorded the Ruby floor dependency in the matrix. The matrix starts at 3.2
while xero-ruby.gemspec still declares required_ruby_version ">= 2.3", so on its
own this workflow ships a gem advertising 2.3 through 3.1 with no CI coverage
there. PR #387 raises the gemspec floor and should land with or before this.
---
 .github/workflows/build-test-lint.yml | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/build-test-lint.yml b/.github/workflows/build-test-lint.yml
index 7d793ad1..0833a02e 100644
--- a/.github/workflows/build-test-lint.yml
+++ b/.github/workflows/build-test-lint.yml
@@ -16,6 +16,11 @@ jobs:
     timeout-minutes: 20
     strategy:
       fail-fast: false
+      # NOTE: this matrix floors at Ruby 3.2, but xero-ruby.gemspec still
+      # declares required_ruby_version ">= 2.3". Until PR #387 raises that
+      # floor to ">= 3.2", the gem advertises support for 2.3 through 3.1
+      # with no CI coverage on those versions. Merge #387 with or before
+      # this workflow, or widen the matrix back down to the gemspec floor.
       matrix:
         include:
           - os: ubuntu-latest
@@ -27,7 +32,7 @@ jobs:
 
     steps:
       - name: Check out event source
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.2.2
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Set up Ruby
         uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0