Move Danger into its own Gemfile, loaded only by its workflow

.github/workflows/danger.yml

@@ -4,10 +4,45 @@ on:
   pull_request:
     types: [opened, reopened, edited, synchronize]
 
+permissions:
+  contents: read
+
+# The steps of numbata/danger-pr-comment's danger-run.yml, which has no way to
+# pick a Gemfile. The report artifact keeps that workflow's names, which
+# danger-comment.yml downloads.
 jobs:
   danger:
-    uses: numbata/danger-pr-comment/.github/workflows/danger-run.yml@v0.1.0
-    secrets: inherit
-    with:
-      ruby-version: '3.4'
-      bundler-cache: true
+    runs-on: ubuntu-latest
+    env:
+      BUNDLE_GEMFILE: ${{ github.workspace }}/gemfiles/danger.gemfile
+    steps:
+    - uses: actions/checkout@v6
+      with:
+        fetch-depth: 0
+
+    - name: Set up Ruby
+      uses: ruby/setup-ruby@v1
+      with:
+        ruby-version: 3.4
+        bundler-cache: true
+
+    - name: Run Danger
+      id: danger
+      continue-on-error: true
+      env:
+        DANGER_GITHUB_API_TOKEN: ${{ github.token }}
+        GITHUB_TOKEN: ${{ github.token }}
+        DANGER_REPORT_PATH: ${{ runner.temp }}/danger-report.json
+      run: bundle exec danger dry_run
+
+    - name: Upload Danger report
+      if: ${{ always() }}
+      uses: actions/upload-artifact@v4
+      with:
+        name: danger-report
+        path: ${{ runner.temp }}/danger-report.json
+        if-no-files-found: error
+
+    - name: Fail if Danger failed
+      if: ${{ steps.danger.outcome == 'failure' }}
+      run: exit 1

CHANGELOG.md

@@ -16,6 +16,7 @@
 * [#3050](https://github.com/ruby-grape/grape/pull/3050): Remove the unused `ParamsScope#root?` and cover the placeholder skip in `validate_elements!` - [@ericproulx](https://github.com/ericproulx).
 * [#3051](https://github.com/ruby-grape/grape/pull/3051): Look up the validation error format once per response instead of once per message - [@ericproulx](https://github.com/ericproulx).
 * [#3055](https://github.com/ruby-grape/grape/pull/3055): Stop a 405 behind `Rack::Cascade` from making the next app answer 405 too - [@ericproulx](https://github.com/ericproulx).
+* [#3057](https://github.com/ruby-grape/grape/pull/3057): Move Danger into its own Gemfile, loaded only by its workflow - [@ericproulx](https://github.com/ericproulx).
 * [#3058](https://github.com/ruby-grape/grape/pull/3058): Declare `rexml` in the test bundle instead of relying on Danger to bring it in - [@ericproulx](https://github.com/ericproulx).
 * Your contribution here.
 

Gemfile

@@ -21,11 +21,6 @@ group :development do
 end
 
 group :test do
-  gem 'danger', require: false
-  gem 'danger-changelog', require: false
-  gem 'danger-pr-comment', require: false
-  # danger 9.6.1 fails to load with git 6: https://github.com/danger/danger/issues/1560
-  gem 'git', '< 6', require: false
   gem 'rack-contrib', require: false
   gem 'rack-test', '~> 2.1'
   # ActiveSupport::XmlMini, Grape's XML backend without multi_xml, parses with

gemfiles/danger.gemfile

@@ -0,0 +1,14 @@
+# frozen_string_literal: true
+
+# Danger's own bundle, used only by .github/workflows/danger.yml, so that its
+# gems stay out of the bundle every other Gemfile evaluates. To run it locally:
+#
+#   BUNDLE_GEMFILE=gemfiles/danger.gemfile bundle exec danger local
+
+source 'https://rubygems.org'
+
+gem 'danger'
+gem 'danger-changelog'
+gem 'danger-pr-comment'
+# danger 9.6.1 fails to load with git 6: https://github.com/danger/danger/issues/1560
+gem 'git', '< 6'