From ee37d8e12306cfb2d2c84bbeaebce6af08a041c6 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 9 Jun 2026 18:50:38 +0000 Subject: [PATCH 1/2] Bump net-imap from 0.6.4 to 0.6.4.1 Bumps [net-imap](https://github.com/ruby/net-imap) from 0.6.4 to 0.6.4.1. - [Release notes](https://github.com/ruby/net-imap/releases) - [Commits](https://github.com/ruby/net-imap/compare/v0.6.4...v0.6.4.1) --- updated-dependencies: - dependency-name: net-imap dependency-version: 0.6.4.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] --- Gemfile.lock | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Gemfile.lock b/Gemfile.lock index ec45316..329703f 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -117,7 +117,7 @@ GEM minitest (6.0.6) drb (~> 2.0) prism (~> 1.5) - net-imap (0.6.4) + net-imap (0.6.4.1) date net-protocol net-pop (0.1.2) From bcb7639861a85ee5b4672344cef091e4bdaa20fa Mon Sep 17 00:00:00 2001 From: Bartosz Date: Wed, 10 Jun 2026 15:48:31 +0200 Subject: [PATCH 2/2] Set a fixed dummy Castle api_secret in the test setup castle-rb 9.1.0 validates that api_secret is present before every request. CI injected an empty CASTLE_API_SECRET on Dependabot runs (which don't get repository secrets), tripping the validation. The VCR cassettes mean no real secret is needed, so the spec setup now sets a fixed dummy api_secret/app_id and the workflow no longer passes the secret. --- .github/workflows/specs.yml | 1 - spec/support/init_castle_device.rb | 8 ++++++-- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/.github/workflows/specs.yml b/.github/workflows/specs.yml index d2db36e..508a24f 100644 --- a/.github/workflows/specs.yml +++ b/.github/workflows/specs.yml @@ -59,7 +59,6 @@ jobs: - name: Run specs env: BUNDLE_GEMFILE: gemfiles/rails_${{ matrix.rails }}.gemfile - CASTLE_API_SECRET: ${{ secrets.CASTLE_API_SECRET }} run: | bundle exec rake - name: Simplecov Report diff --git a/spec/support/init_castle_device.rb b/spec/support/init_castle_device.rb index 39eabf9..cad91cc 100644 --- a/spec/support/init_castle_device.rb +++ b/spec/support/init_castle_device.rb @@ -1,7 +1,11 @@ # frozen_string_literal: true CastleDevise.configure do |config| - config.api_secret = ENV.fetch("CASTLE_API_SECRET", "fake-secret-123") - config.app_id = ENV.fetch("CASTLE_APP_ID", "123456789") + # Explicitly set a non-empty api_secret. The castle-rb SDK validates that + # api_secret is present before every request, and the VCR cassettes mean + # no real secret is needed, so a fixed dummy value keeps the specs valid + # everywhere (including Dependabot runs that don't get repo secrets). + config.api_secret = "fake-secret-123" + config.app_id = "123456789" config.logger = Logger.new($stdout) end