input bundler: 2.7.2 didn't run bundle lock with the correct version

Ensure the following before filing this issue

I verified it reproduces with the latest version with - uses: ruby/setup-ruby@v1 (see Versioning policy)
I tried to reproduce the issue locally by following the workflow steps (including all commands done by ruby/setup-ruby, except for Downloading Ruby & Extracting Ruby),
and it did not reproduce locally (if it does reproduce locally, it's not a ruby/setup-ruby issue)

Are you running on a GitHub-hosted runner or a self-hosted runner?

GitHub-hosted runner

Link to the failed workflow job (must be a public workflow job, so the necessary information is available)

https://github.com/sinatra/sinatra/actions/runs/20523194500/job/58961833171?pr=2136#step:4:4

Any other notes?

Here the bundler: input is set to 2.72.: https://github.com/sinatra/sinatra/actions/runs/20523194500/job/58961833171?pr=2136#step:4:4
Here bundler 2.7.2 is installed: https://github.com/sinatra/sinatra/actions/runs/20523194500/job/58961833171?pr=2136#step:4:32
but BUNDLED WITH in the generated lockfile is 4.0.3 https://github.com/sinatra/sinatra/actions/runs/20523194500/job/58961833171?pr=2136#step:4:487

Looks like BUNDLER_VERSION (the env variable) is only set for Bundler 1

setup-ruby/bundler.js

Lines 165 to 170 in ae195bb

    
           if (bundlerVersion.startsWith('1') && common.isBundler2PlusDefault(engine, rubyVersion)) { 
        
             // If Bundler 1 is specified on Rubies which ship with Bundler 2+, 
        
             // we need to specify which Bundler version to use explicitly until the lockfile exists. 
        
             console.log(`Setting BUNDLER_VERSION=${bundlerVersion} for "bundle config|lock" commands below to ensure Bundler 1 is used`) 
        
             envOptions = { env: { ...process.env, BUNDLER_VERSION: bundlerVersion } } 
        
           }

I think it would make sense to include BUNDLER_VERSION in envOptions that the bundle lock command uses. I haven't looked if it makes sense in all scenarios but at least when bundler: is set to a specific version.

setup-ruby/bundler.js

Line 184 in ae195bb

await exec.exec('bundle', ['lock'], envOptions)

For the record I'm able to workaround this issue like this (removing the generated lockfile, running bundle install with BUNDLER_VERSION set) sinatra/sinatra@c694c06

I see, thanks for the report.
I think this is only a problem when there is no checked-in Gemfile.lock, as that would pick the right version due to Bundler auto-switching.

Set BUNDLER_VERSION whenever we know which version to use

Repro'd in https://github.com/ruby/setup-ruby/actions/runs/20625380512/job/59234986980

Set BUNDLER_VERSION whenever we know which version to use

Navigation Menu

Repository navigation

input `bundler: 2.7.2` didn't run `bundle lock` with the correct version #845

Ensure the following before filing this issue

Are you running on a GitHub-hosted runner or a self-hosted runner?

Link to the failed workflow job (must be a public workflow job, so the necessary information is available)

Any other notes?

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

	if (bundlerVersion.startsWith('1') && common.isBundler2PlusDefault(engine, rubyVersion)) {
	// If Bundler 1 is specified on Rubies which ship with Bundler 2+,
	// we need to specify which Bundler version to use explicitly until the lockfile exists.
	console.log(`Setting BUNDLER_VERSION=${bundlerVersion} for "bundle config\|lock" commands below to ensure Bundler 1 is used`)
	envOptions = { env: { ...process.env, BUNDLER_VERSION: bundlerVersion } }
	}

input bundler: 2.7.2 didn't run bundle lock with the correct version #845

Description

Ensure the following before filing this issue

Are you running on a GitHub-hosted runner or a self-hosted runner?

Link to the failed workflow job (must be a public workflow job, so the necessary information is available)

Any other notes?

Activity

dentarg commented on Dec 27, 2025

dentarg commented on Dec 27, 2025

eregon commented on Dec 31, 2025

eregon commented on Dec 31, 2025

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

input `bundler: 2.7.2` didn't run `bundle lock` with the correct version #845