feat: onboarding setup-ruby action

.github/workflows/actions_release.yml

@@ -0,0 +1,36 @@
+name: Release GitHub Actions
+
+on:
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Tag for the release"
+        required: true
+      node_version:
+        description: "Node.js version to use"
+        required: false
+        default: "24"
+      script:
+        description: "Script to build/bundle the action"
+        required: false
+        default: "yarn package"
+      yarn_version:
+        required: false
+        type: string
+
+permissions:
+  contents: read
+
+jobs:
+  release:
+    permissions:
+      actions: read
+      id-token: write
+      contents: write
+
+    uses: step-security/reusable-workflows/.github/workflows/actions_release.yaml@v1
+    with:
+      tag: "${{ github.event.inputs.tag }}"
+      node_version: ${{ inputs.node_version || '24' }}
+      script: ${{ inputs.script || 'yarn package' }}
+      yarn_version: ${{ inputs.yarn_version || '4.15.0' }}

.github/workflows/audit_package.yml

@@ -23,6 +23,9 @@ on:
         description: "Package manager to use"
         required: false
         default: "yarn"
+      yarn_version:
+        required: false
+        type: string
   schedule:
     - cron: "0 0 * * 1"
 
@@ -35,6 +38,7 @@ jobs:
       node_version: ${{ inputs.node_version || '24' }}
       script: ${{ inputs.script || 'yarn package' }}
       package_manager: ${{ inputs.package_manager || 'yarn' }}
+      yarn_version: ${{ inputs.yarn_version || '4.15.0' }}
 
 permissions:
   contents: write

.github/workflows/auto_cherry_pick.yml

@@ -0,0 +1,56 @@
+name: Auto Cherry-Pick from Upstream
+
+on:
+  workflow_run:
+    workflows: [ "Release GitHub Actions" ]
+    types:
+      - completed
+
+  workflow_dispatch:
+    inputs:
+      base_branch:
+        description: "Base branch to create the PR against"
+        required: true
+        default: "main"
+      mode:
+        description: "Run mode: cherry-pick or verify"
+        required: false
+        default: "cherry-pick"
+      node_version:
+        description: "Node.js version to use"
+        required: false
+        default: "24"
+      script:
+        description: "Script to build/bundle the action"
+        required: false
+        default: "yarn package"
+      package_manager:
+        description: "Package manager to use"
+        required: false
+        default: "yarn"
+      yarn_version:
+        required: false
+        type: string
+
+  pull_request:
+    types: [ opened, synchronize, labeled ]
+
+permissions:
+  contents: write
+  pull-requests: write
+  packages: read
+  issues: write
+
+jobs:
+  cherry-pick:
+    if: (github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success') || github.event_name == 'workflow_dispatch' || contains(fromJson(toJson(github.event.pull_request.labels)).*.name, 'review-required')
+    uses: step-security/reusable-workflows/.github/workflows/auto_cherry_pick.yaml@v1
+    with:
+      original-owner: "ruby"
+      repo-name: "setup-ruby"
+      base_branch: ${{ inputs.base_branch || 'main' }}
+      mode: ${{ github.event_name == 'pull_request' && 'verify' || inputs.mode || 'cherry-pick' }}
+      node_version: ${{ inputs.node_version || '24' }}
+      script: ${{ inputs.script || 'yarn package' }}
+      package_manager: ${{ inputs.package_manager || 'yarn' }}
+      yarn_version: ${{ inputs.yarn_version || '4.15.0' }}