From e95abc99648f3a3839a8beba4212a4760ba320a9 Mon Sep 17 00:00:00 2001
From: Eric Proulx <playmaverick@gmail.com>
Date: Fri, 6 Nov 2026 18:39:54 +0100
Subject: [PATCH] Move Danger into its own Gemfile, loaded only by its workflow

Danger ran from the main Gemfile's :test group, which every gemfile in
gemfiles/ evaluates. So each test job resolved and installed Danger's
gems as well: 28 of the bundle's 90, Faraday, Octokit and kramdown
among them. The `git < 6` pin (#3045) went to every bundle too.

gemfiles/danger.gemfile now holds danger, danger-changelog,
danger-pr-comment and the git pin, and nothing else, not even the
gemspec. The main Gemfile drops them.

numbata/danger-pr-comment's danger-run.yml can't pick a Gemfile, and a
caller's env doesn't reach a reusable workflow. danger.yml therefore
runs that workflow's steps itself, with BUNDLE_GEMFILE set on the job.
The report artifact keeps the same names, so danger-comment.yml still
posts the PR comment unchanged. The Dangerfile is unchanged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/workflows/danger.yml |  3 ++-
 CHANGELOG.md                 |  1 +
 Gemfile                      |  5 -----
 gemfiles/danger.gemfile      | 14 ++++++++++++++
 4 files changed, 17 insertions(+), 6 deletions(-)
 create mode 100644 gemfiles/danger.gemfile

diff --git a/.github/workflows/danger.yml b/.github/workflows/danger.yml
index bd89a888d..7fb36395a 100644
--- a/.github/workflows/danger.yml
+++ b/.github/workflows/danger.yml
@@ -6,8 +6,9 @@ on:
 
 jobs:
   danger:
-    uses: numbata/danger-pr-comment/.github/workflows/danger-run.yml@v0.1.0
+    uses: numbata/danger-pr-comment/.github/workflows/danger-run.yml@v0.2.0
     secrets: inherit
     with:
       ruby-version: '3.4'
+      gemfile: gemfiles/danger.gemfile
       bundler-cache: true
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 121f327f9..c85f3f1cd 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -3,6 +3,7 @@
 #### Features
 
 * [#3052](https://github.com/ruby-grape/grape/pull/3052): Add `Grape::ErrorFormatter::ProblemJson` to answer errors as RFC 9457 problem details - [@ericproulx](https://github.com/ericproulx).
+* [#3062](https://github.com/ruby-grape/grape/pull/3062): Use the reusable Danger workflow with a separate Gemfile - [@dblock](https://github.com/dblock).
 * Your contribution here.
 
 #### Fixes
diff --git a/Gemfile b/Gemfile
index ec6eac2ba..41e95ef63 100644
--- a/Gemfile
+++ b/Gemfile
@@ -21,11 +21,6 @@ group :development do
 end
 
 group :test do
-  gem 'danger', require: false
-  gem 'danger-changelog', require: false
-  gem 'danger-pr-comment', require: false
-  # danger 9.6.1 fails to load with git 6: https://github.com/danger/danger/issues/1560
-  gem 'git', '< 6', require: false
   gem 'rack-contrib', require: false
   gem 'rack-test', '~> 2.1'
   # ActiveSupport::XmlMini, Grape's XML backend without multi_xml, parses with
diff --git a/gemfiles/danger.gemfile b/gemfiles/danger.gemfile
new file mode 100644
index 000000000..ac88c345c
--- /dev/null
+++ b/gemfiles/danger.gemfile
@@ -0,0 +1,14 @@
+# frozen_string_literal: true
+
+# Danger's own bundle, used only by .github/workflows/danger.yml, so that its
+# gems stay out of the bundle every other Gemfile evaluates. To run it locally:
+#
+#   BUNDLE_GEMFILE=gemfiles/danger.gemfile bundle exec danger local
+
+source 'https://rubygems.org'
+
+gem 'danger'
+gem 'danger-changelog'
+gem 'danger-pr-comment'
+# danger 9.6.1 fails to load with git 6: https://github.com/danger/danger/issues/1560
+gem 'git', '< 6'