WA-NEW-012: Update GitHub Actions CI Ruby version (>= 2.7)

[kitcommerce]

Problem

CI on next and all current PRs is red because GitHub Actions is running Ruby 2.6.10 (see run 22201068208), but workarea-core requires Ruby >= 2.7.0, < 3.3.0. Bundler fails during dependency resolution.

Goal

Make CI green again by updating CI to run Ruby >= 2.7 (prefer 2.7.8 for now, consistent with local dev), and ensure this applies to next and PRs targeting next.

Scope

• Update the workflow(s) in .github/workflows/* and/or the shared workarea-commerce/ci@v1 action inputs to use Ruby >= 2.7
• Decide whether to pin to 2.7.8 or move to a matrix (2.7 + 3.1)
• Ensure bundler-cache still works

Acceptance Criteria

• Latest CI run on next passes bundler install step
• At least one PR run completes all jobs past bundler install
• Document Ruby version choice in repo (README/dev docs or workflow comments)

Notes

• Current failure excerpt: Because every version of workarea-core depends on Ruby >= 2.7.0 ... current Ruby version is = 2.6.10, version solving has failed.

[kitcommerce]

Dispatched to implementer session "workarea-#636-wa-new-012". Branch pattern: wa-new-012-*. PR will target next.

[kitcommerce]

PR opened for review: #641 (wa-new-012-ci-ruby-2-7 → next). Summary: bump CI Ruby to 2.7.8 + pin bundler 2.4.22; ensure PRs to next run CI; replace legacy workarea-commerce/ci actions with explicit ruby/setup-ruby steps; install docker-compose; set bundler-audit + rubocop to continue-on-error to avoid unrelated debt blocking CI while validating pipeline.

[kitcommerce]

Fix Brief — PR #641 (WA-NEW-012)

Wave 1 reviewers returned items that need to be addressed before we proceed.

Architecture (CHANGES_REQUIRED — MEDIUM)

• DRY up repeated service bootstrap (docker-compose install / start services / wait for ES) across jobs.
• Replace brittle runtime discovery: do not parse rake -T output to build a command.
• Make ES readiness a real gate (remove || false so tests can't proceed without ES).

Security (CHANGES_REQUIRED — MEDIUM)

• Remove unsafe dynamic execution pattern:
  • Current: bundle exec $(bundle exec rake -T | grep services:up | ...)
  • Replace with explicit static command(s) (e.g. bundle exec rake services:up) or a safe allowlist.
• Pin GitHub Actions to commit SHAs (supply-chain hardening) for at least actions/checkout and ruby/setup-ruby.
• Decide intentionally whether continue-on-error: true for Bundler Audit/Rubocop is acceptable; if it should gate merges, remove it.

Rails Conventions (CHANGES_REQUIRED — MEDIUM)

• Same as above: avoid parsing rake -T output; call a dedicated CI task explicitly.
• If continue-on-error is temporary, document it; otherwise enforce.

Simplicity (PASS_WITH_NOTES)

• Prefer explicit bundle exec rake services:up.
• Consider factoring repeated steps into a composite action, reusable workflow, or YAML anchors.

Target branch: wa-new-012-ci-ruby-2-7 (PR #641)

Verification:

• Ensure workflow remains valid YAML.
• CI should fail fast if services don't come up (ES readiness is fatal).
• Confirm service startup is explicit/static (no $(...) executing derived text).
• Preferably: Actions pinned to SHAs.