Audit the docs, README and homepage against the code, and fix what they promised

.cspell.json

@@ -7,7 +7,10 @@
     "node_modules/**"
   ],
   "overrides": [],
-  "ignoreRegExpList": [],
+  "ignoreRegExpList": [
+    "/\\b[A-Za-z]+'[A-Za-z]+\\b/g",
+    "/\\\\e\\[[0-9;]*m/g"
+  ],
   "useGitignore": true,
   "dictionaryDefinitions": [
     {
@@ -23,7 +26,6 @@
   ],
   "dictionaries": [
     "project-words",
-    "lockfile-words-root",
-    "lockfile-words-docs"
+    "lockfile-words-root"
   ]
 }

.cspell/project-words.txt

@@ -1,4 +1,7 @@
+activemodelserializers
 ankane
+apikey
+apikeys
 appender
 appenders
 autorun
@@ -7,51 +10,62 @@ binstub
 binstubs
 Bugsnag
 bytesize
+byteslice
 carrierwave
 codegen
 creds
+crypted
 dalli
 defn
 demodulize
 docspring
 dotenv
 duplicable
-Dotenv
 ESRCH
 Fanout
 favicons
+FFFD
 gettime
 goodjob
 gosu
 Healthcheck
+HMAC
 Honeybadger
 hostnames
 hotwire
 hrefs
 instrumenter
 Itest
 ivar
+justinko
+jwts
 kamal
 klass
 kwargs
+langalex
 lightningcss
 lockfiles
+logcraft
 logdev
 logfield
+logstasher
 Logstop
 LogStruct
+Luhn
 metaprogramming
 mswin
 nilability
 nilable
 nonblock
 nonblocking
 optparse
+otps
 parseable
 passw
 pentester
 pentesters
 popen
+Procfile
 procs
 progname
 railtie
@@ -62,29 +76,23 @@ reraise
 reraises
 reraising
 Rescuable
+Resque
 resultset
 Rollbar
 rsig
 RUBYGEMS
 shadcn
 shiki
 Sidekiq
+signm
+SIGUSR
 solargraph
 ssns
 TESTOPTS
 testtask
+tsort
+unwritable
 vercel
 wordlists
 xorshift
 yardoc
-tsort
-HMAC
-otps
-crypted
-jwts
-Luhn
-byteslice
-unwritable
-FFFD
-signm
-SIGUSR

.github/workflows/deploy-docs.yml

@@ -42,7 +42,7 @@ jobs:
           echo "sha=${run#* }" >> "$GITHUB_OUTPUT"
 
       - name: Checkout the commit that CI run tested
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ steps.ci_run.outputs.sha }}
           persist-credentials: false
@@ -59,7 +59,7 @@ jobs:
           version: 10.18.3
 
       - name: Setup Node with the pnpm cache
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: '22'
           cache: 'pnpm'
@@ -70,12 +70,12 @@ jobs:
           cd docs && pnpm install --frozen-lockfile
 
       - name: Setup Pages
-        uses: actions/configure-pages@1f0c5cde4bc74cd7e1254d0cb4de8d49e9068c7d # v4.0.0
+        uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
         with:
           static_docs_generator: next
 
       - name: Download that run's coverage report
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: coverage-ruby-rails-latest
           path: docs/public/coverage/
@@ -94,7 +94,7 @@ jobs:
         run: cd docs && pnpm run build
 
       - name: Upload artifact
-        uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3.0.1
+        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
         with:
           path: ./docs/out
 
@@ -113,4 +113,4 @@ jobs:
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5
+        uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5.0.1

.github/workflows/rails-main.yml

@@ -15,7 +15,7 @@ jobs:
     env:
       RUBY_VERSION: '4.0.1'
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 

.github/workflows/release.yml

@@ -25,13 +25,43 @@ env:
   TAG_NAME: ${{ github.ref_type == 'tag' && github.ref_name || '' }}
 
 jobs:
+  # Every other job needs this one, so a tag that doesn't match version.rb publishes nothing
   wait_ci:
-    name: Wait for CI success on tag
+    name: Validate the tag and wait for CI success
     runs-on: ubuntu-latest
     permissions:
       contents: read
       actions: read # to read the CI runs for the tagged commit
+    outputs:
+      version: ${{ steps.ver.outputs.version_tag }}
     steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Determine version and validate tag
+        id: ver
+        shell: bash
+        run: |
+          TAG="$TAG_NAME"
+          if [[ -z "$TAG" ]]; then
+            TAG="v0.0.0-dryrun"
+            echo "DRY-RUN: Using placeholder tag $TAG" >&2
+          fi
+          VERSION_FROM_TAG="${TAG#v}"
+          VERSION_RB=$(sed -n 's/^ *VERSION *= *"\([^"]*\)".*/\1/p' lib/log_struct/version.rb)
+          echo "version_tag=$VERSION_FROM_TAG" >> "$GITHUB_OUTPUT"
+          echo "Resolved tag: $TAG (version $VERSION_FROM_TAG); code version: $VERSION_RB"
+          if [[ -z "$VERSION_RB" ]]; then
+            echo "::error::Couldn't read VERSION from lib/log_struct/version.rb."
+            exit 1
+          fi
+          if [[ "$DRY_RUN" != "true" && "$VERSION_FROM_TAG" != "$VERSION_RB" ]]; then
+            echo "::error::Tag version ($VERSION_FROM_TAG) does not match lib/log_struct/version.rb ($VERSION_RB). Update version.rb before tagging, or run as dry-run."
+            exit 1
+          fi
+
       - name: Wait for CI workflow
         env:
           GH_TOKEN: ${{ github.token }}
@@ -76,7 +106,7 @@ jobs:
       gem_file: ${{ steps.build.outputs.gem_file }}
     steps:
       - name: Checkout
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -87,28 +117,10 @@ jobs:
         with:
           ruby-version: '.ruby-version'
 
-      - name: Determine version and validate tag
-        id: ver
-        shell: bash
-        run: |
-          TAG="$TAG_NAME"
-          if [[ -z "$TAG" ]]; then
-            TAG="v0.0.0-dryrun"
-            echo "DRY-RUN: Using placeholder tag $TAG" >&2
-          fi
-          VERSION_FROM_TAG="${TAG#v}"
-          VERSION_RB=$(ruby -e 'print File.read("lib/log_struct/version.rb")[/VERSION\s*=\s*"([^"]+)"/,1]')
-          echo "version_tag=$VERSION_FROM_TAG" >> "$GITHUB_OUTPUT"
-          echo "Resolved tag: $TAG (version $VERSION_FROM_TAG); code version: $VERSION_RB"
-          if [[ "$DRY_RUN" != "true" && "$VERSION_FROM_TAG" != "$VERSION_RB" ]]; then
-            echo "::error::Tag version ($VERSION_FROM_TAG) does not match lib/log_struct/version.rb ($VERSION_RB). Update version.rb before tagging, or run as dry-run."
-            exit 1
-          fi
-
       - name: Build gem
         id: build
         env:
-          VERSION: ${{ steps.ver.outputs.version_tag }}
+          VERSION: ${{ needs.wait_ci.outputs.version }}
         run: |
           gem build logstruct.gemspec
           ls -la ./*.gem
@@ -129,7 +141,7 @@ jobs:
           echo "gem_file=$GEM_FILE" >> "$GITHUB_OUTPUT"
 
       - name: Upload the gem
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: gem
           path: ${{ steps.build.outputs.gem_file }}
@@ -153,7 +165,7 @@ jobs:
       id-token: write # RubyGems trusted publishing: exchanges this job's OIDC token for a short-lived API key
     steps:
       - name: Download the gem
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: gem
 
@@ -176,7 +188,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -203,7 +215,7 @@ jobs:
         run: ruby scripts/export_provider_catalog.rb
 
       - name: Setup Go
-        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: '1.22'
           cache: false
@@ -229,7 +241,7 @@ jobs:
           fi
 
       - name: Upload the provider changes
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: provider-changes
           path: provider-changes.patch
@@ -244,7 +256,7 @@ jobs:
     environment: release
     steps:
       - name: Download the provider changes
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: provider-changes
 

.github/workflows/terraform-example.yml

@@ -18,19 +18,19 @@ jobs:
   validate:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Setup Terraform
-        uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3.1.2
+        uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e # v4.0.1
         with:
           terraform_version: 1.7.5
       - name: Terraform Init (example)
         run: terraform -chdir=terraform-example init -backend=false
       - name: Terraform Validate (example)
         run: terraform -chdir=terraform-example validate
       - name: Setup TFLint
-        uses: terraform-linters/setup-tflint@90f302c255ef959cbfb4bd10581afecdb7ece3e6 # v4.1.1
+        uses: terraform-linters/setup-tflint@6ffdbaa3be476b3431f7275c26966ef32ff60337 # v6.3.2
       - name: TFLint (core rules only)
         run: |
           # TFLint >= 0.47 removed positional directory args; use --chdir