Change SOCKET_PATCH_COMMAND from 'socket patch apply' to
'npx @socketsecurity/socket-patch apply' so it works without
the socket CLI being globally installed.

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* feat: unflag Ruby gem support and add e2e bundler tests

Remove the `gem` feature flag so Ruby gem support is always compiled in,
matching npm and PyPI which are already default-on. This ensures gem
support ships in every release binary built with `cargo build --release`.

- Remove `gem = []` from both Cargo.toml feature sections
- Remove all `#[cfg(feature = "gem")]` gates from crawler module,
  Ecosystem enum, PURL functions, and ecosystem dispatch
- Rewrite e2e_gem.rs with full bundler lifecycle tests targeting
  activestorage@5.2.0 (CVE-2022-21831) with 3-file hash verification
- Add Ruby 3.2 setup step in CI for e2e_gem suite
- Update READMEs to reflect gem as default, not feature-flagged

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: split clippy into own CI job and fix broken update.rs tests

- Move clippy into a dedicated `clippy` job so it runs independently
  from tests and is separately visible in PR checks
- Remove `components: clippy` from the test job (no longer needed)
- Fix 2 pre-existing test failures in package_json::update::tests:
  assertions checked for "socket patch apply" (space) but the
  SOCKET_PATCH_COMMAND writes "socket-patch apply" (hyphen)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: pin ruby/setup-ruby action to full commit SHA

GitHub org policy requires all actions to be pinned to full-length
commit SHAs. Pin ruby/setup-ruby@v1 to its current SHA.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: use dynamic hash verification in gem e2e tests

Instead of hardcoded before/after hashes (which were incorrect
placeholders), read expected hashes from the manifest after `get`
and record original hashes dynamically after install. This matches
the pattern used by the pypi e2e tests.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

- Upgrade actions/checkout from v4 to v6.0.2 (SHA-pinned) across all workflows
- Add persist-credentials: false to all checkout steps that don't need
  git credentials (all CI jobs, and release build/publish jobs)
- Fix excessive-permissions in release.yml: replace workflow-level
  contents:write + id-token:write with permissions:{} at workflow level
  and minimal per-job permissions (contents:write only for sync-and-tag
  and github-release; contents:read + id-token:write for publish jobs)

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

…oot package.json (#45)

* fix: only add postinstall to root package.json for pnpm monorepos

pnpm runs root lifecycle scripts on `pnpm install`, so adding
postinstall scripts to individual workspace package.json files is
unnecessary. Worse, it breaks because workspaces may not have
`@socketsecurity/socket-patch` as a dependency, and pnpm's strict
module isolation prevents `npx` from resolving it.

The setup command now detects pnpm monorepos (via pnpm-workspace.yaml)
and only updates the root package.json.

Also fixes detection order: pnpm-workspace.yaml is now checked before
the "workspaces" field in package.json, since pnpm projects often have
both for compatibility, and pnpm-workspace.yaml is the definitive
signal.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: correct ruby/setup-ruby version comment to match SHA

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: split release workflow into PR-based prep + auto-publish

The previous release workflow pushed version bumps directly to main,
which is blocked by branch protection rules. Split into two workflows:

1. release-prep.yml (workflow_dispatch): bumps version and opens a PR
2. release.yml (on PR merge): tags, builds, and publishes when a
   release/v* branch is merged to main

This allows releases without needing admin bypass for github-actions[bot].

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: use env var to prevent template injection in release workflow

Passes github.event.pull_request.head.ref through an env variable
instead of direct template expansion to satisfy zizmor audit.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: simplify release to workflow_dispatch (no bot commits needed)

Replace the two-workflow PR-based release flow with a single
workflow_dispatch trigger, matching the socket-cli pattern.

Changes:
- Remove release-prep.yml (automated version bump + PR creation)
- Make release.yml a manual workflow_dispatch that reads the version
  from Cargo.toml, tags, builds, and publishes
- Add dry-run option to build without publishing
- Use NPM_TOKEN secret for npm publish (fixes ENEEDAUTH on new packages)
- Add registry-url to setup-node for proper auth

Release flow after this change:
1. Bump version in a PR: run scripts/version-sync.sh, commit, merge
2. Click "Run workflow" on Release
3. Done - tags, builds, and publishes automatically

This avoids the signed commit requirement that blocked github-actions[bot]
from pushing to protected branches.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: remove NPM_TOKEN, use OIDC trusted publishing like socket-cli

The original ENEEDAUTH failure was caused by missing registry-url in
setup-node, not missing NPM_TOKEN. With registry-url set, OIDC
trusted publishing works for both existing and new packages.

Also fixes zizmor secrets-outside-env warnings.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: restore NPM_TOKEN with environment for new package publishing

OIDC trusted publishing doesn't work for brand new packages that
don't exist on the npm registry yet. The new -gnu/-musl packages
need NPM_TOKEN for their first publish.

Added `environment: npm-publish` to satisfy zizmor's
secrets-outside-env audit. The environment needs to be created
in the repo settings with the NPM_TOKEN secret.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: use pure OIDC trusted publishing, matching socket-cli/socket-mcp

Remove NPM_TOKEN and environment — use the same OIDC pattern as
socket-cli and socket-mcp. The registry-url in setup-node enables
the OIDC token exchange.

Note: new packages that don't exist on npm yet must be pre-created
manually before the first publish.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>