[ericproulx]

Why

Danger ran from the main Gemfile's :test group, and every gemfile in gemfiles/ evaluates that file. So every test job, across the whole Rack/Rails/Ruby matrix, resolved and installed Danger's gems as well: 28 of the bundle's 90, including Faraday, Octokit and kramdown. The git < 6 pin (#3045, for danger/danger#1560) applied to every bundle too.

What changes

• gemfiles/danger.gemfile (new) holds danger, danger-changelog, danger-pr-comment and the git < 6 pin. It has nothing else, not even the gemspec. The lockfile is already covered by gemfiles/*.lock in .gitignore.
• Gemfile drops those four gems. The main bundle goes from 90 gems to 62.
• .github/workflows/danger.yml runs the steps of numbata/danger-pr-comment's danger-run.yml itself, with BUNDLE_GEMFILE set on the job. That reusable workflow has no input for a Gemfile, and env set by the caller doesn't reach a workflow_call job. The workflow name (Danger) and the report artifact (danger-report / danger-report.json) are unchanged, so danger-comment.yml keeps posting the PR comment as before. The run job now gets only the read-only github.token, rather than secrets: inherit.
• Dangerfile is unchanged.

To run Danger locally: BUNDLE_GEMFILE=gemfiles/danger.gemfile bundle exec danger local.

Checked locally

• The Danger bundle resolves to 45 gems, none of them Grape or Rack.
• danger dry_run from that bundle, with a simulated pull_request event, writes a clean report for this commit. On a throwaway commit with a malformed CHANGELOG line it exits 1 and reports the danger-changelog error.
• bundle exec rake on the main bundle: 379 files with no offenses, 3184 examples, 0 failures. The XML specs still pass, now that Declare rexml in the test bundle #3058 declares rexml, which used to arrive only through Danger's kramdown.

The real check is this PR's own Danger run and its comment, since a PR runs its own workflow files.

🤖 Generated with Claude Code

[dblock]

I’m an AI posting on behalf of @dblock.

I’m generally against replacing purpose-built tooling with custom code just to reduce dependencies. By that logic, we could replace RuboCop with scripts checking only the rules we use—but then we own the implementation, automated tests, and maintenance.

Danger is the right tool for this job. I’d rather fix danger-changelog’s false positives and missing checks, and isolate its dependencies from the main test matrix. I recently wrote One Tool for the Spell-Checking Job arguing that tools are cheap; maintaining our own replacements isn’t. The workflow permissions and secret handling are worth improving separately.

Please retain Danger and address these issues in the existing tooling and workflow rather than introducing a bespoke changelog checker.

[github-actions]

Danger Report

No issues found.

View run

[ericproulx]

I’m an AI posting on behalf of @dblock.

I’m generally against replacing purpose-built tooling with custom code just to reduce dependencies. By that logic, we could replace RuboCop with scripts checking only the rules we use—but then we own the implementation, automated tests, and maintenance.

Danger is the right tool for this job. I’d rather fix danger-changelog’s false positives and missing checks, and isolate its dependencies from the main test matrix. I recently wrote One Tool for the Spell-Checking Job arguing that tools are cheap; maintaining our own replacements isn’t. The workflow permissions and secret handling are worth improving separately.

Please retain Danger and address these issues in the existing tooling and workflow rather than introducing a bespoke changelog checker.

ok the only reason I wanted Danger out is because of all the dependencies it brought in the gemfile for a single CI check. Instead, I've isolated Danger in it's own Gemfile so that it's not polluting the test env. What do you think ?

[dblock]

Allow selecting a Gemfile in Danger Run workflow numbata/danger-pr-comment#13

That makes sense, let's add it as a feature to danger-pr-comment to avoid duplicating workflows, https://github.com/numbata/danger-pr-comment/pull/13, hold this while we work on that.

[dblock]

Use #3062