Moving public gems to a private source in the gemfile

[noelrappin]

Describe the problem as clearly as you can

We have been seeing cases where public gems (like Rails) have had their position in the gemfile.lock moved from the public source to inside the listing for a private source

I can't show a full example, but the pattern is

GEM
  remote: <our internal gem source>
  specs:
   internal-gem (1.1.0)
     <dependencies>
   rails (7.2.1)
     <dependencies>

GEM
  remote: https://rubygems.org
  specs:

Rails shouldn't be showing up as coming from our internal source.

I think, but I'm not sure, that it happens when a public gem is a dependency of an internal gem.

Did you try upgrading rubygems & bundler?

This seems to happen on the current version

Post steps to reproduce the problem

It appears to happen on a normal bundle update when a private gem has a public gem as a dependency

-->

Which command did you run?

bundle update

What were you expecting to happen?

regular bundle update

What actually happened?

public gems get moved to our private source

If not included with the output of your command, run bundle env and paste the output below

[deivid-rodriguez]

If confirmed that this happens with the latest version (we've fixed similar issues in the past), it would be a bug, but without more information, I don't think we can do anything about it. We need more information and a way to reproduce it.

[noelrappin]

Yeah, I get that, but it happens intermittently for us? Working on it...

[deivid-rodriguez]

Yeah, intermittent issues are tough! Thanks for working on that repro.

[noelrappin]

Is there a way I can test this without giving access to our internal gem source?

[deivid-rodriguez]

I normally suggest to setup dummy private repos (for example, using https://docs.github.com/en/packages/working-with-a-github-packages-registry/working-with-the-rubygems-registry) that simulate the dependency relationships that you have in your private gems, but removing all private code (and renaming the private gems if you want, too).

[deivid-rodriguez]

I'll close for now but do reopen if you find a way to reproduce. Thanks!