From 561290b8d96d929d2d38be2d81d0f048fbc61f47 Mon Sep 17 00:00:00 2001
From: Eric Proulx <playmaverick@gmail.com>
Date: Fri, 6 Nov 2026 18:39:54 +0100
Subject: [PATCH] Move Danger into its own Gemfile, loaded only by its workflow

Danger ran from the main Gemfile's :test group, which every gemfile in
gemfiles/ evaluates. So each test job resolved and installed Danger's
gems as well: 28 of the bundle's 90, Faraday, Octokit and kramdown
among them. The `git < 6` pin (#3045) went to every bundle too.

gemfiles/danger.gemfile now holds danger, danger-changelog,
danger-pr-comment and the git pin, and nothing else, not even the
gemspec. The main Gemfile drops them.

numbata/danger-pr-comment's danger-run.yml can't pick a Gemfile, and a
caller's env doesn't reach a reusable workflow. danger.yml therefore
runs that workflow's steps itself, with BUNDLE_GEMFILE set on the job.
The report artifact keeps the same names, so danger-comment.yml still
posts the PR comment unchanged. The Dangerfile is unchanged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/workflows/danger.yml | 45 ++++++++++++++++++++++++++++++++----
 CHANGELOG.md                 |  1 +
 Gemfile                      |  5 ----
 gemfiles/danger.gemfile      | 14 +++++++++++
 4 files changed, 55 insertions(+), 10 deletions(-)
 create mode 100644 gemfiles/danger.gemfile

diff --git a/.github/workflows/danger.yml b/.github/workflows/danger.yml
index bd89a888d..76bea9bbf 100644
--- a/.github/workflows/danger.yml
+++ b/.github/workflows/danger.yml
@@ -4,10 +4,45 @@ on:
   pull_request:
     types: [opened, reopened, edited, synchronize]
 
+permissions:
+  contents: read
+
+# The steps of numbata/danger-pr-comment's danger-run.yml, which has no way to
+# pick a Gemfile. The report artifact keeps that workflow's names, which
+# danger-comment.yml downloads.
 jobs:
   danger:
-    uses: numbata/danger-pr-comment/.github/workflows/danger-run.yml@v0.1.0
-    secrets: inherit
-    with:
-      ruby-version: '3.4'
-      bundler-cache: true
+    runs-on: ubuntu-latest
+    env:
+      BUNDLE_GEMFILE: ${{ github.workspace }}/gemfiles/danger.gemfile
+    steps:
+    - uses: actions/checkout@v6
+      with:
+        fetch-depth: 0
+
+    - name: Set up Ruby
+      uses: ruby/setup-ruby@v1
+      with:
+        ruby-version: 3.4
+        bundler-cache: true
+
+    - name: Run Danger
+      id: danger
+      continue-on-error: true
+      env:
+        DANGER_GITHUB_API_TOKEN: ${{ github.token }}
+        GITHUB_TOKEN: ${{ github.token }}
+        DANGER_REPORT_PATH: ${{ runner.temp }}/danger-report.json
+      run: bundle exec danger dry_run
+
+    - name: Upload Danger report
+      if: ${{ always() }}
+      uses: actions/upload-artifact@v4
+      with:
+        name: danger-report
+        path: ${{ runner.temp }}/danger-report.json
+        if-no-files-found: error
+
+    - name: Fail if Danger failed
+      if: ${{ steps.danger.outcome == 'failure' }}
+      run: exit 1
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 121f327f9..c9457ab45 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -16,6 +16,7 @@
 * [#3050](https://github.com/ruby-grape/grape/pull/3050): Remove the unused `ParamsScope#root?` and cover the placeholder skip in `validate_elements!` - [@ericproulx](https://github.com/ericproulx).
 * [#3051](https://github.com/ruby-grape/grape/pull/3051): Look up the validation error format once per response instead of once per message - [@ericproulx](https://github.com/ericproulx).
 * [#3055](https://github.com/ruby-grape/grape/pull/3055): Stop a 405 behind `Rack::Cascade` from making the next app answer 405 too - [@ericproulx](https://github.com/ericproulx).
+* [#3057](https://github.com/ruby-grape/grape/pull/3057): Move Danger into its own Gemfile, loaded only by its workflow - [@ericproulx](https://github.com/ericproulx).
 * [#3058](https://github.com/ruby-grape/grape/pull/3058): Declare `rexml` in the test bundle instead of relying on Danger to bring it in - [@ericproulx](https://github.com/ericproulx).
 * Your contribution here.
 
diff --git a/Gemfile b/Gemfile
index ec6eac2ba..41e95ef63 100644
--- a/Gemfile
+++ b/Gemfile
@@ -21,11 +21,6 @@ group :development do
 end
 
 group :test do
-  gem 'danger', require: false
-  gem 'danger-changelog', require: false
-  gem 'danger-pr-comment', require: false
-  # danger 9.6.1 fails to load with git 6: https://github.com/danger/danger/issues/1560
-  gem 'git', '< 6', require: false
   gem 'rack-contrib', require: false
   gem 'rack-test', '~> 2.1'
   # ActiveSupport::XmlMini, Grape's XML backend without multi_xml, parses with
diff --git a/gemfiles/danger.gemfile b/gemfiles/danger.gemfile
new file mode 100644
index 000000000..ac88c345c
--- /dev/null
+++ b/gemfiles/danger.gemfile
@@ -0,0 +1,14 @@
+# frozen_string_literal: true
+
+# Danger's own bundle, used only by .github/workflows/danger.yml, so that its
+# gems stay out of the bundle every other Gemfile evaluates. To run it locally:
+#
+#   BUNDLE_GEMFILE=gemfiles/danger.gemfile bundle exec danger local
+
+source 'https://rubygems.org'
+
+gem 'danger'
+gem 'danger-changelog'
+gem 'danger-pr-comment'
+# danger 9.6.1 fails to load with git 6: https://github.com/danger/danger/issues/1560
+gem 'git', '< 6'