chore: Raise test_gem ruby/setup-ruby version

[kaylareopelle]

I'm trying to use SimpleCov in #1509, but TruffleRuby raises an error about Coverage.running? not being implemented. There's a fix for this in TruffleRuby 22.

TruffleRuby 22 isn't accessible with the test_gem action's current version of ruby/setup-ruby. However, TruffleRuby 23 is available on the latest ruby/setup-ruby version. Using v1.152.0 fixed the problem.

Example action failure: https://github.com/open-telemetry/opentelemetry-ruby/actions/runs/5744430524/job/15570701339?pr=1509#step:7:150

[simi]

ℹ️ it is possible to setup dependabot for actions, I can try to setup that if welcomed in separate PR

[robbkidd]

👍🏻 Newer is Better!

I approve newer ... and while we're on the subject, the setup-ruby maintainers recommend riding the lightning and tracking the v1 branch instead of specific pinned versions. Have we considered and rejected that idea already at some time in the past?

[simi]

👍🏻 Newer is Better!

I approve newer ... and while we're on the subject, the setup-ruby maintainers recommend riding the lightning and tracking the v1 branch instead of specific pinned versions. Have we considered and rejected that idea already at some time in the past?

We had similar discussion in rubygems.org. Per https://securityscorecards.dev/, GitHub Actions should be pinned to actual commit, not to version, to minimise the risk of pulling in unexpected changes (potentially with security concerns). That works well combined with dependabot. That way you can scan the changelog at least (or changes), but get updated often.

I can try to configure both if welcomed - https://github.com/ossf/scorecard-action and monthly/weekly dependabot for actions.

[kaylareopelle]

Thanks, all! I've added a note to chat about how we want to set the ruby/setup-ruby action versions to next week's SIG agenda.

https://docs.google.com/document/d/1D15bO8o340sQm2CVZiukEJuCO_XMMHKPuTznoEhyFqE/edit