ci(workflows): test Ruby 4.0 and tighten lint and release

Author: rdavid

.github/workflows/dependency-review.yml

@@ -7,7 +7,7 @@ name: dependency-review
     paths:
       - Gemfile
       - Gemfile.lock
-      - transcode.gemspec
+      - '*.gemspec'
       - .github/workflows/dependency-review.yml
 permissions:
   contents: read

.github/workflows/gitleaks.yml

@@ -29,8 +29,8 @@ jobs:
     steps:
       - uses: actions/checkout@v7.0.1
         with:
-          persist-credentials: false
           fetch-depth: 0
+          persist-credentials: false
       - uses: gitleaks/gitleaks-action@v3.0.0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/pages.yml

@@ -5,7 +5,10 @@ name: pages
 'on':
   push:
     branches: [master]
-    paths: [README.adoc, .github/pages/**]
+    paths:
+      - README.adoc
+      - .github/pages/**
+      - .github/workflows/pages.yml
   workflow_dispatch:
 permissions:
   contents: read

.github/workflows/rake.yml

@@ -35,9 +35,10 @@ jobs:
           - windows-2022
           - windows-2025
         ruby:
-          - 3.2
-          - 3.3
-          - 3.4
+          - '3.2'
+          - '3.3'
+          - '3.4'
+          - '4.0'
         include:
           - os: ubuntu-24.04
             ruby: head

.github/workflows/release.yml

@@ -23,11 +23,14 @@ jobs:
           persist-credentials: false
       - uses: ruby/setup-ruby@v1.336.0
         with:
-          ruby-version: '3.4'
+          ruby-version: '4.0'
       - name: Verify the tag matches the gem version
         run: |
           ver="$(ruby -Ilib -rtranscode/version -e 'puts Transcode::VERSION')"
           test "$ver" = "$GITHUB_REF_NAME"
+      - run: |
+          bundle install
+          bundle exec rake
       - uses: rubygems/configure-rubygems-credentials@v2.1.0
       - run: gem build transcode.gemspec
       - run: gem push "transcode-$GITHUB_REF_NAME.gem"

.github/workflows/rubocop.yml

@@ -3,7 +3,8 @@
 #
 # The pull-requests:write permission below is scoped to the rubocop job
 # alone (not the workflow default) so that reviewdog can post inline
-# review comments on the triggering pull request.
+# review comments on the triggering pull request. The github-pr-review
+# reporter replaces the default github-pr-check one for the same reason.
 ---
 name: rubocop
 'on':
@@ -41,10 +42,10 @@ jobs:
           persist-credentials: false
       - uses: ruby/setup-ruby@v1.336.0
         with:
-          ruby-version: 3.2
+          ruby-version: '3.2'
           bundler-cache: true
       - uses: reviewdog/action-rubocop@v2.22.0
         with:
-          reporter: github-pr-review  # Default is github-pr-check
+          reporter: github-pr-review
           skip_install: true
           use_bundler: true

.github/workflows/yamllint.yml

@@ -27,8 +27,5 @@ jobs:
           persist-credentials: false
       - uses: ibiqlik/action-yamllint@v3.1.1
         with:
-          file_or_dir: >
-            ./.github/*.yml
-            ./.github/workflows/*.yml
-            ./.rubocop.yml
+          file_or_dir: .
           strict: true