[release/0.2.z] TC-2240 OSV GHSA - Ecosystem RubyGems

[mrizzi]

https://issues.redhat.com/browse/TC-2240

Backport:

• TC-2240 OSV GHSA - Ecosystem RubyGems #1281

[ctron]

I'm against backporting by default. That turned out to be tricky with the last release. Let's just merge main into the release branch before doing a release,.

[mrizzi]

I'm against backporting by default. That turned out to be tricky with the last release. Let's just merge main into the release branch before doing a release,.

I can see the "all-in" pattern works fine in this phase when no selectivity in what to release (vs what is committed into main) is required.
But in the mid-term, how can we think about having this selectivity without it being tricky?
In the past, in other projects, we successfully used a tool that did the backport for us simply applying two labels on the PR (opened on main branch) to-be-backported, so really pretty basic with no effort involved but with the great benefit of having selectivity to ensure project maintenance.

Could we give this tool a try in this phase to decide if it fits in this context as well?

@ctron @dejanb @jcrossley3 WDYT?

[ctron]

In the past, in other projects, we successfully used a tool that did the backport for us simply applying two labels on the PR (opened on main branch) to-be-backported, so really pretty basic with no effort involved but with the great benefit of having selectivity to ensure project maintenance.

Could we give this tool a try in this phase to decide if it fits in this context as well?

I'd love that.

[mrizzi]

Merged into release/0.2.z branch when releasing trustify 0.2.4