Install bundler via gem install (heroku#1680)

* Install bundler via `gem install`

Previously we downloaded a version from S3. This moves the classic buildpack to be more like the CNB https://github.com/heroku/buildpacks-ruby/blob/8729d93fbef99696ec1f039a4accc52a2f98f3bc/buildpacks/ruby/src/layers/bundle_download_layer.rs.

* Shell out to parse Gemfile.lock

This strategy can also be used in the Ruby CNB. This is needed to make this a refactor and preserve the ability to set default_config_vars before calling `bundle install` based on gems (versus after calling `bundle install` we can use `bundle list` output/parsing).

* Install bundler where we want it from the beginning

We know where bundler will live, we can put it in the right place from the start.

* Fix cache logic

The prior directory check only looked at `vendor/bundle/#{engine}/#{major}.#{minor}.0` (which does not include the bundler version). This prevented installing/updating bundler versions. The logic now checks the specific bundler version before skipping installation.

* Changelog

* Unit test new lockfile parsing functionality

Author: schneems

CHANGELOG.md

@@ -2,6 +2,11 @@
 
 ## [Unreleased]
 
+- Bundler version is now installed via running `gem install bundler` previously it was pre-built
+  and downloaded directly from S3.
+
+ This change should be a refactor (no observed change in build behavior). If your app can build with `https://github.com/heroku/heroku-buildpack-ruby#v334` but not with this version, please open a
+ support ticket https://help.heroku.com/. (https://github.com/heroku/heroku-buildpack-ruby/pull/1680)
 
 ## [v339] - 2026-01-05
 

lib/language_pack.rb

@@ -50,7 +50,7 @@ def self.call(app_path:, cache_path:, gemfile_lock:, bundle_default_without:, en
       io: warn_io
     )
 
-    bundler = Helpers::BundlerWrapper.new.install
+    bundler = Helpers::BundlerWrapper.new(bundler_path: ruby_version.bundler_directory).install
     default_config_vars = Ruby.default_config_vars(metadata: metadata, ruby_version: ruby_version, bundler: bundler, environment_name: environment_name)
     Ruby.setup_language_pack_environment(
       app_path: app_path.expand_path,
@@ -59,7 +59,6 @@ def self.call(app_path:, cache_path:, gemfile_lock:, bundle_default_without:, en
       bundle_default_without: bundle_default_without,
       default_config_vars: default_config_vars
     )
-    Ruby.install_bundler_in_app(bundler_src_dir: bundler.bundler_path, app_bundler_dir: ruby_version.bundler_directory)
     Ruby.load_bundler_cache(
       ruby_version: ruby_version,
       new_app: new_app,
@@ -139,6 +138,7 @@ def self.detect(arch:, app_path:, cache_path:, environment_name:, gemfile_lock:,
 require "language_pack/helpers/rails_runner"
 require "language_pack/helpers/puma_warn_error"
 require "language_pack/helpers/bundler_wrapper"
+require "language_pack/helpers/lockfile_shell_parser"
 require "language_pack/helpers/default_env_vars"
 require "language_pack/helpers/outdated_ruby_version"
 require "language_pack/helpers/download_presence"

lib/language_pack/helpers/bundler_wrapper.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-require 'language_pack/fetcher'
+require "json"
 
 # This class is responsible for installing and maintaining a
 # reference to bundler. It contains access to bundler internals
@@ -9,7 +9,7 @@
 #
 # Example:
 #
-#   bundler = LanguagePack::Helpers::BundlerWrapper.new
+#   bundler = LanguagePack::Helpers::BundlerWrapper.new(bundler_path: "vendor/bundle/ruby/3.2.0")
 #   bundler.install
 #   bundler.version                 => "1.15.2"
 #   bundler.dir_name                => "bundler-1.15.2"
@@ -22,7 +22,7 @@
 # of an isolated dyno, you must call `BundlerWrapper#clean`. To reset the environment
 # variable:
 #
-#   bundler = LanguagePack::Helpers::BundlerWrapper.new
+#   bundler = LanguagePack::Helpers::BundlerWrapper.new(bundler_path: "vendor/bundle/ruby/3.2.0")
 #   bundler.install
 #   bundler.clean # <========== IMPORTANT =============
 #
@@ -109,13 +109,11 @@ def initialize(version_hash, major_minor)
   attr_reader :bundler_path
 
   def initialize(
-      bundler_path: nil,
+      bundler_path:,
       gemfile_path: Pathname.new("./Gemfile"),
       report: HerokuBuildReport::GLOBAL
     )
     @report               = report
-    @bundler_tmp          = Pathname.new(Dir.mktmpdir)
-    @fetcher              = LanguagePack::Fetcher.new(LanguagePack::Base::VENDOR_URL) # coupling
     @gemfile_path         = gemfile_path
     @gemfile_lock_path    = Pathname.new("#{@gemfile_path}.lock")
 
@@ -143,38 +141,30 @@ def initialize(
     )
     @dir_name = "bundler-#{@version}"
 
-    @bundler_path         = bundler_path || @bundler_tmp.join(@dir_name)
-    @bundler_tar          = "bundler/#{@dir_name}.tgz"
+    @bundler_path = Pathname(bundler_path)
     @orig_bundle_gemfile  = ENV['BUNDLE_GEMFILE']
-    @path                 = Pathname.new("#{@bundler_path}/gems/#{@dir_name}/lib")
   end
 
   def install
     ENV['BUNDLE_GEMFILE'] = @gemfile_path.to_s
-
     fetch_bundler
-    $LOAD_PATH << @path
-    require "bundler"
     self
   end
 
   def clean
     ENV['BUNDLE_GEMFILE'] = @orig_bundle_gemfile
-    @bundler_tmp.rmtree if @bundler_tmp.directory?
   end
 
   def has_gem?(name)
     specs.key?(name)
   end
 
   def gem_version(name)
-    if spec = specs[name]
-      spec.version
-    end
+    specs[name]
   end
 
   def specs
-    @specs ||= lockfile_parser.specs.each_with_object({}) {|spec, hash| hash[spec.name] = spec }
+    @specs ||= specs_from_lockfile
   end
 
   def version
@@ -193,10 +183,6 @@ def self.platform_to_version(bundle_platform_output)
     end
   end
 
-  def lockfile_parser
-    @lockfile_parser ||= parse_gemfile_lock
-  end
-
   def bundler_version_escape_valve!
     topic("Removing BUNDLED WITH version in the Gemfile.lock")
     contents = File.read(@gemfile_lock_path, mode: "rt")
@@ -207,7 +193,7 @@ def bundler_version_escape_valve!
 
   private
   def fetch_bundler
-    return true if Dir.exist?(bundler_path)
+    return true if Dir.exist?(bundler_path.join("gems", dir_name))
 
     topic("Installing bundler #{@version}")
     bundler_version_escape_valve!
@@ -221,14 +207,11 @@ def fetch_bundler
     # - extensions
     # - doc
     FileUtils.mkdir_p(bundler_path)
-    Dir.chdir(bundler_path) do
-      @fetcher.fetch_untar(@bundler_tar)
-    end
-    Dir["bin/*"].each {|path| `chmod 755 #{path}` }
+    run!("GEM_HOME=#{bundler_path} gem install bundler --version #{@version} --no-document --env-shebang")
   end
 
-  def parse_gemfile_lock
-    gemfile_contents = File.read(@gemfile_lock_path)
-    Bundler::LockfileParser.new(gemfile_contents)
+  # Runs a Ruby subprocess to parse the Gemfile.lock and return specs as a hash.
+  def specs_from_lockfile
+    LanguagePack::Helpers::LockfileShellParser.call(lockfile_path: @gemfile_lock_path)
   end
 end

lib/language_pack/helpers/lockfile_shell_parser.rb

@@ -0,0 +1,56 @@
+# frozen_string_literal: true
+
+require "json"
+
+module LanguagePack
+  module Helpers
+    # Parses gem specs from a Gemfile.lock file using Bundler::LockfileParser.
+    #
+    # This module encapsulates the logic for extracting gem names and versions
+    # from a lockfile, running the parsing in a subprocess to avoid polluting
+    # the current process's Bundler state.
+    #
+    # This can be called before gems are installed (but after Ruby and Bundler are installed).
+    # The output of this and `bundle list` (which can only be invoked after gems are installed)
+    # will disagree based on env vars such as `BUNDLE_WITHOUT`.
+    #
+    # This output will usually be a superset of `bundle list` output.
+    #
+    # Example:
+    #
+    #   specs = LockfileShellParser.call(lockfile_path: "/path/to/Gemfile.lock")
+    #   specs["rake"] # => #<Gem::Version "13.2.1">
+    #
+    module LockfileShellParser
+      extend LanguagePack::ShellHelpers
+
+      RUBY_PARSER_CODE = <<~RUBY
+        require "json"
+        require "bundler"
+
+        path = ARGV[0] or raise "First argument must be the path to the Gemfile.lock"
+        specs = Bundler::LockfileParser.new(File.read(path))
+          .specs
+          .each_with_object({}) {|spec, hash| hash[spec.name.to_s] = spec.version.to_s }
+        puts specs.to_json
+      RUBY
+
+      # Parses gem specs from a Gemfile.lock file path.
+      #
+      # @param lockfile_path [String, Pathname] Path to the Gemfile.lock file
+      # @return [Hash{String => Gem::Version}] Hash of gem names to their versions
+      #
+      # Example:
+      #
+      #   specs = LockfileShellParser.call(lockfile_path: "Gemfile.lock")
+      #   specs["rails"]    # => #<Gem::Version "7.0.4">
+      #   specs["nokogiri"] # => #<Gem::Version "1.15.0">
+      #
+      def self.call(lockfile_path:)
+        output = run!("ruby -e #{RUBY_PARSER_CODE.shellescape} #{lockfile_path.to_s.shellescape}", out: "2>/dev/null")
+        JSON.parse(output).transform_values { |version| Gem::Version.new(version) }
+      end
+    end
+  end
+end
+

lib/language_pack/ruby.rb

@@ -539,13 +539,6 @@ def self.install_ruby(app_path: , ruby_version: , stack:, arch: , metadata:, io:
     io.error message
   end
 
-  # installs vendored gems into the slug
-  def self.install_bundler_in_app(bundler_src_dir:, app_bundler_dir:)
-    FileUtils.mkdir_p(app_bundler_dir)
-    Dir.chdir(app_bundler_dir) do |dir|
-      `cp -R #{bundler_src_dir}/. .`
-    end
-  end
 
   # default set of binaries to install
   # @return [Array] resulting list
@@ -933,8 +926,13 @@ def self.load_bundler_cache(cache: , metadata: , stack:, bundler_cache: , bundle
 
   def self.purge_bundler_cache(bundler_cache: , stack:  nil, ruby_version: , bundler:)
     bundler_cache.clear(stack)
-    # need to reinstall language pack gems
-    install_bundler_in_app(bundler_src_dir: bundler.bundler_path, app_bundler_dir: ruby_version.bundler_directory)
+    # need to reinstall bundler
+    bundler.install
+  end
+
+  def purge_bundler_cache(stack = nil)
+    @bundler_cache.clear(stack)
+    bundler.install
   end
 
   # writes ERB based database.yml for Rails. The database.yml uses the DATABASE_URL from the environment during runtime.

spec/hatchet/getting_started_spec.rb

@@ -8,8 +8,10 @@
 
       secret_key_base = app.run("echo $SECRET_KEY_BASE")
 
+      set_bundler_version(version: "2.6.9")
+
       # Re-deploy with cache
-      run!("git commit --allow-empty -m empty")
+      run!("git add .; git commit -m 'Change bundler version'")
       app.push!
 
       # Assert used cached gems

spec/hatchet/rails6_spec.rb

@@ -3,7 +3,7 @@
 describe "Rails 6" do
   it "should detect successfully" do
     Hatchet::App.new('rails61').in_directory_fork do
-      bundler = LanguagePack::Helpers::BundlerWrapper.new.install
+      bundler = LanguagePack::Helpers::BundlerWrapper.new(bundler_path: Dir.mktmpdir)
       expect(LanguagePack::Rails5.use?(bundler: bundler)).to eq(false)
       expect(LanguagePack::Rails6.use?(bundler: bundler)).to eq(true)
     end

spec/hatchet/rails7_spec.rb

@@ -3,7 +3,7 @@
 describe "Rails 7" do
   it "should detect successfully" do
     Hatchet::App.new('rails-jsbundling').in_directory_fork do
-      bundler = LanguagePack::Helpers::BundlerWrapper.new.install
+      bundler = LanguagePack::Helpers::BundlerWrapper.new(bundler_path: Dir.mktmpdir)
       expect(LanguagePack::Rails6.use?(bundler: bundler)).to eq(false)
       expect(LanguagePack::Rails7.use?(bundler: bundler)).to eq(true)
     end

spec/helpers/bundler_wrapper_spec.rb

@@ -72,6 +72,7 @@
       report = HerokuBuildReport.dev_null
 
       bundler = LanguagePack::Helpers::BundlerWrapper.new(
+        bundler_path: Dir.mktmpdir,
         gemfile_path: gemfile,
         report: report
       )
@@ -96,7 +97,7 @@
       ENV['RUBYOPT'] = ENV['RUBYOPT'].sub('-rbundler/setup', '')
     end
 
-    @bundler = LanguagePack::Helpers::BundlerWrapper.new
+    @bundler = LanguagePack::Helpers::BundlerWrapper.new(bundler_path: Dir.mktmpdir)
   end
 
   after(:each) do
@@ -117,7 +118,7 @@
 
       expect(tmp_gemfile_lock_path.read).to match("BUNDLED")
 
-      wrapper = LanguagePack::Helpers::BundlerWrapper.new(gemfile_path: tmp_gemfile_path )
+      wrapper = LanguagePack::Helpers::BundlerWrapper.new(bundler_path: Dir.mktmpdir, gemfile_path: tmp_gemfile_path)
 
       expect(wrapper.version).to eq(LanguagePack::Helpers::BundlerWrapper::BLESSED_BUNDLER_VERSIONS["2"])
 

spec/helpers/fetcher_spec.rb

@@ -10,7 +10,7 @@
           lockfile.write("BUNDLED WITH\n   #{version}")
 
           fetcher = LanguagePack::Fetcher.new(LanguagePack::Base::VENDOR_URL)
-          fetcher.fetch_untar("bundler/#{LanguagePack::Helpers::BundlerWrapper.new.dir_name}.tgz")
+          fetcher.fetch_untar("bundler/#{LanguagePack::Helpers::BundlerWrapper.new(bundler_path: Dir.mktmpdir).dir_name}.tgz")
 
           expect(run!("ls bin")).to match("bundle")
         end