feat(bundler): add Ruby/Bundler ecosystem support (#54)

* feat(bundler): add Ruby/Bundler ecosystem support

Add deps-bundler crate with full Gemfile and Gemfile.lock support:

- Gemfile DSL parser with regex-based extraction
- Gemfile.lock parser with state machine for sections
- rubygems.org API client with HTTP caching
- Version comparison with pessimistic operator (~>)
- Support for git, path, github dependency sources
- Group handling (development, test, production)

Implements Ecosystem, Dependency, Version, Metadata traits from deps-core.

* fix(bundler): improve diagnostics and add README

- Fix "Unknown package" false positives for gems in lock file
- Parse DEPENDENCIES section for platform-specific gems
- Fix clippy warnings (unnecessary raw string hashes)
- Add README.md for deps-bundler crate

* chore: bump version to 0.6.0

Add Ruby/Bundler ecosystem support as new minor version.

* chore(bundler): add benchmarks and CI coverage

Add criterion benchmarks for Gemfile and Gemfile.lock parsing with
various file sizes (5-100 deps). Configure codecov upload for
deps-bundler in CI workflow.

* chore(ci): simplify codecov upload to single action

Codecov automatically applies flags based on paths defined in
codecov.yml. Remove redundant per-crate uploads (8 -> 1).
Add missing flags for deps-go and deps-bundler.

* test(bundler): increase test coverage to 90%+

Add comprehensive tests for error handling, parser edge cases,
registry response parsing, and type implementations. Migrate CI
to moonrepo/setup-rust, remove sccache. Add codecov flags for
deps-go and deps-bundler.

* docs: update CHANGELOG with bundler improvements

Author: bug-ops

.github/codecov.yml

@@ -41,7 +41,13 @@ ignore:
   - "crates/deps-zed/**/*"  # WASM extension has limited testing
 
 # Per-crate flags for detailed coverage tracking
+# Codecov automatically filters coverage by paths defined here
 flags:
+  overall:
+    paths:
+      - crates/
+    carryforward: true
+
   deps-core:
     paths:
       - crates/deps-core/src/
@@ -62,6 +68,16 @@ flags:
       - crates/deps-pypi/src/
     carryforward: true
 
+  deps-go:
+    paths:
+      - crates/deps-go/src/
+    carryforward: true
+
+  deps-bundler:
+    paths:
+      - crates/deps-bundler/src/
+    carryforward: true
+
   deps-lsp:
     paths:
       - crates/deps-lsp/src/

.github/workflows/ci.yml

@@ -8,7 +8,6 @@ on:
   schedule:
     - cron: '0 0 * * 0'  # Weekly dependency check
 
-# Restrict permissions for all jobs by default
 permissions:
   contents: read
 
@@ -20,13 +19,11 @@ env:
   RUSTFLAGS: "-D warnings"
   RUSTUP_MAX_RETRIES: 10
 
-# Cancel previous runs on new push
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
 jobs:
-  # Detect changes to skip unnecessary jobs
   changes:
     name: Detect Changes
     runs-on: ubuntu-latest
@@ -51,7 +48,6 @@ jobs:
             workflows:
               - '.github/workflows/**'
 
-  # Format check (nightly for Edition 2024)
   fmt:
     name: Format
     needs: changes
@@ -61,15 +57,17 @@ jobs:
     steps:
       - uses: actions/checkout@v6
 
-      - name: Install Rust nightly
-        uses: dtolnay/rust-toolchain@nightly
+      - uses: moonrepo/setup-rust@v1
         with:
+          channel: nightly
           components: rustfmt
+          cache: false
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Check formatting
-        run: cargo fmt --all -- --check
+        run: cargo +nightly fmt --all -- --check
 
-  # Clippy and docs (stable)
   check:
     name: Check
     needs: changes
@@ -79,16 +77,11 @@ jobs:
     steps:
       - uses: actions/checkout@v6
 
-      - name: Install Rust stable
-        uses: dtolnay/rust-toolchain@stable
+      - uses: moonrepo/setup-rust@v1
         with:
           components: clippy
-
-      - name: Cache Cargo
-        uses: Swatinem/rust-cache@v2
-        with:
-          shared-key: "check"
-          save-if: ${{ github.ref == 'refs/heads/main' }}
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Clippy
         run: cargo clippy --workspace --all-targets --all-features -- -D warnings
@@ -98,7 +91,6 @@ jobs:
         env:
           RUSTDOCFLAGS: "-D warnings"
 
-  # Security audit
   security:
     name: Security Audit
     needs: changes
@@ -117,12 +109,6 @@ jobs:
       - name: Run cargo-deny
         run: cargo deny check
 
-      # Note: cargo-semver-checks removed for pre-1.0 development
-      # Checking semver compliance for 7 crates takes 5-7 minutes
-      # and is not valuable for pre-1.0 versions (breaking changes allowed)
-      # Re-enable when approaching 1.0.0 release
-
-  # Cross-platform tests with matrix
   test:
     name: Test (${{ matrix.os }}${{ matrix.target && format(' / {0}', matrix.target) || '' }})
     needs: [changes, fmt, check]
@@ -135,10 +121,8 @@ jobs:
         os: [ubuntu-latest, macos-latest, windows-latest]
         rust: [stable]
         include:
-          # Test on beta channel on Linux only
           - os: ubuntu-latest
             rust: beta
-          # Cross-compile check for Windows ARM64
           - os: windows-latest
             rust: stable
             target: aarch64-pc-windows-msvc
@@ -147,29 +131,20 @@ jobs:
     steps:
       - uses: actions/checkout@v6
 
-      - name: Install Rust ${{ matrix.rust }}
-        uses: dtolnay/rust-toolchain@master
+      - uses: moonrepo/setup-rust@v1
         with:
-          toolchain: ${{ matrix.rust }}
+          channel: ${{ matrix.rust }}
           targets: ${{ matrix.target }}
+          bins: cargo-nextest
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
-      # Platform-specific setup
       - name: Install dependencies (Ubuntu)
         if: matrix.os == 'ubuntu-latest'
         run: |
           sudo apt-get update
           sudo apt-get install -y libssl-dev pkg-config
 
-      - name: Cache Cargo
-        uses: Swatinem/rust-cache@v2
-        with:
-          shared-key: "test-${{ matrix.os }}${{ matrix.target && format('-{0}', matrix.target) || '' }}"
-          save-if: ${{ github.ref == 'refs/heads/main' }}
-
-      - name: Install nextest
-        if: ${{ !matrix.cross }}
-        uses: taiki-e/install-action@nextest
-
       - name: Run tests
         if: ${{ !matrix.cross }}
         run: cargo nextest run --workspace --all-features --no-fail-fast
@@ -182,10 +157,6 @@ jobs:
         if: ${{ matrix.cross }}
         run: cargo build --workspace --target ${{ matrix.target }}
 
-  # Code coverage (Linux only for speed)
-  # Optimized: Single test run with codecov flags for per-crate tracking
-  # Previous approach ran tests 7 times (1 overall + 6 per-crate) taking ~15 min
-  # New approach: Single run with flags takes ~5 min (67% faster, 67% less runner cost)
   coverage:
     name: Code Coverage
     needs: [changes, fmt, check]
@@ -195,92 +166,30 @@ jobs:
     steps:
       - uses: actions/checkout@v6
 
-      - name: Install Rust
-        uses: dtolnay/rust-toolchain@stable
-
-      - name: Install llvm-cov and nextest
-        uses: taiki-e/install-action@v2
-        with:
-          tool: cargo-llvm-cov,cargo-nextest
-
-      - name: Cache Cargo
-        uses: Swatinem/rust-cache@v2
+      - uses: moonrepo/setup-rust@v1
         with:
-          shared-key: "coverage"
+          bins: cargo-llvm-cov,cargo-nextest
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Generate coverage (single run for all crates)
-        run: |
-          cargo llvm-cov --all-features --workspace --lcov \
-            --output-path lcov.info nextest
+      - name: Generate coverage
+        run: cargo llvm-cov --all-features --workspace --lcov --output-path lcov.info nextest
 
-      # Upload overall coverage with overall flag
-      - name: Upload overall coverage
+      - name: Upload coverage
         uses: codecov/codecov-action@v5
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           files: lcov.info
-          flags: overall
           fail_ci_if_error: false
           verbose: true
 
-      # Upload per-crate coverage using flags
-      # Codecov automatically filters by file paths in each crate
-      - name: Upload deps-core coverage
-        uses: codecov/codecov-action@v5
-        with:
-          token: ${{ secrets.CODECOV_TOKEN }}
-          files: lcov.info
-          flags: deps-core
-          fail_ci_if_error: false
-
-      - name: Upload deps-cargo coverage
-        uses: codecov/codecov-action@v5
-        with:
-          token: ${{ secrets.CODECOV_TOKEN }}
-          files: lcov.info
-          flags: deps-cargo
-          fail_ci_if_error: false
-
-      - name: Upload deps-npm coverage
-        uses: codecov/codecov-action@v5
-        with:
-          token: ${{ secrets.CODECOV_TOKEN }}
-          files: lcov.info
-          flags: deps-npm
-          fail_ci_if_error: false
-
-      - name: Upload deps-pypi coverage
-        uses: codecov/codecov-action@v5
-        with:
-          token: ${{ secrets.CODECOV_TOKEN }}
-          files: lcov.info
-          flags: deps-pypi
-          fail_ci_if_error: false
-
-      - name: Upload deps-go coverage
-        uses: codecov/codecov-action@v5
-        with:
-          token: ${{ secrets.CODECOV_TOKEN }}
-          files: lcov.info
-          flags: deps-go
-          fail_ci_if_error: false
-
-      - name: Upload deps-lsp coverage
-        uses: codecov/codecov-action@v5
-        with:
-          token: ${{ secrets.CODECOV_TOKEN }}
-          files: lcov.info
-          flags: deps-lsp
-          fail_ci_if_error: false
-
       - name: Archive coverage report
         uses: actions/upload-artifact@v4
         with:
           name: coverage-report
           path: lcov.info
           retention-days: 30
 
-  # MSRV check
   msrv:
     name: Check MSRV
     needs: [changes, fmt, check]
@@ -296,23 +205,15 @@ jobs:
           MSRV=$(grep '^rust-version' Cargo.toml | sed 's/.*"\(.*\)".*/\1/')
           echo "version=$MSRV" >> $GITHUB_OUTPUT
 
-      - name: Install Rust ${{ steps.msrv.outputs.version }}
-        uses: dtolnay/rust-toolchain@master
+      - uses: moonrepo/setup-rust@v1
         with:
-          toolchain: ${{ steps.msrv.outputs.version }}
-
-      - name: Cache Cargo
-        uses: Swatinem/rust-cache@v2
-        with:
-          shared-key: "msrv"
+          channel: ${{ steps.msrv.outputs.version }}
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Check with MSRV
         run: cargo check --workspace --all-features
 
-  # WASM build check for Zed extension
-  # Note: deps-zed is now a separate repository (submodule).
-  # WASM build is handled in the deps-zed repo CI.
-  # This job now validates that submodule is properly configured.
   wasm:
     name: WASM Build (Zed Extension)
     needs: [changes, fmt, check]
@@ -324,15 +225,12 @@ jobs:
         with:
           submodules: true
 
-      - name: Install Rust
-        uses: dtolnay/rust-toolchain@stable
+      - uses: moonrepo/setup-rust@v1
         with:
           targets: wasm32-wasip1
-
-      - name: Cache Cargo
-        uses: Swatinem/rust-cache@v2
-        with:
-          shared-key: "wasm"
+          cache-target: release
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Build Zed extension
         working-directory: crates/deps-zed
@@ -343,7 +241,6 @@ jobs:
           ls -lh crates/deps-zed/target/wasm32-wasip1/release/*.wasm
           du -sh crates/deps-zed/target/wasm32-wasip1/release/*.wasm
 
-  # Verify benchmarks compile (without running)
   benchmark:
     name: Check Benchmarks
     needs: [changes, fmt, check]
@@ -353,19 +250,13 @@ jobs:
     steps:
       - uses: actions/checkout@v6
 
-      - name: Install Rust
-        uses: dtolnay/rust-toolchain@stable
-
-      - name: Cache Cargo
-        uses: Swatinem/rust-cache@v2
-        with:
-          shared-key: "bench"
-          save-if: ${{ github.ref == 'refs/heads/main' }}
+      - uses: moonrepo/setup-rust@v1
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Build benchmarks
         run: cargo build --workspace --benches
 
-  # Release build check
   release-check:
     name: Release Build Check
     needs: [test]
@@ -374,13 +265,11 @@ jobs:
     steps:
       - uses: actions/checkout@v6
 
-      - name: Install Rust
-        uses: dtolnay/rust-toolchain@stable
-
-      - name: Cache Cargo
-        uses: Swatinem/rust-cache@v2
+      - uses: moonrepo/setup-rust@v1
         with:
-          shared-key: "release"
+          cache-target: release
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Build release
         run: cargo build --workspace --release --all-features
@@ -390,7 +279,6 @@ jobs:
           ls -lh target/release/
           du -sh target/release/
 
-  # All checks passed
   ci-success:
     name: CI Success
     needs: [changes, fmt, check, security, test, coverage, msrv, wasm, benchmark]
@@ -399,13 +287,11 @@ jobs:
     steps:
       - name: Check all jobs
         run: |
-          # If no relevant changes, all skipped jobs are OK
           if [[ "${{ needs.changes.outputs.rust }}" != "true" && "${{ needs.changes.outputs.workflows }}" != "true" ]]; then
             echo "No relevant changes - skipped jobs are OK"
             exit 0
           fi
 
-          # Check if any required job failed (skipped is OK for conditional jobs)
           check_job() {
             local result="$1"
             local name="$2"