feat: add support for Go, Ruby, and NuGet modules with integration testing configurations

Signed-off-by: d9pouces <github@19pouces.net>

tests/configs/Apk.yaml.j2

@@ -27,3 +27,9 @@ configurations:
     repositories: []
   rust:
     repositories: []
+  go:
+    repositories: []
+  ruby:
+    repositories: []
+  nuget:
+    repositories: []

tests/configs/Apt.yaml.j2

@@ -30,3 +30,9 @@ configurations:
     repositories: []
   rust:
     repositories: []
+  go:
+    repositories: []
+  ruby:
+    repositories: []
+  nuget:
+    repositories: []

tests/configs/Certificate.yaml.j2

@@ -24,3 +24,9 @@ configurations:
     repositories: []
   rust:
     repositories: []
+  go:
+    repositories: []
+  ruby:
+    repositories: []
+  nuget:
+    repositories: []

tests/configs/Go.yaml.j2

@@ -0,0 +1,34 @@
+uuid: 3f1a2b4c-5d6e-4f70-8a91-2b3c4d5e6f70
+organisation: InterDiode
+description: Go test configuration
+configurations:
+  certificates:
+  - name: Test CA
+    content: |
+{{ 'certs/test-ca.crt.pem' | file | indent(6, first=true) }}
+  apt:
+    sources: []
+    keys: []
+  apk:
+    repositories: []
+  yum:
+    repositories: []
+    keys: []
+  python:
+    repositories: []
+  java:
+    repositories: []
+  php:
+    repositories: []
+  npm:
+    repositories: []
+  rust:
+    repositories: []
+  go:
+    repositories:
+    - name: demo
+      url: https://host.docker.internal:{{ 'GO_REPO_PORT' | env }}/
+  ruby:
+    repositories: []
+  nuget:
+    repositories: []

tests/configs/Java.yaml.j2

@@ -39,3 +39,9 @@ configurations:
     repositories: []
   rust:
     repositories: []
+  go:
+    repositories: []
+  ruby:
+    repositories: []
+  nuget:
+    repositories: []

tests/configs/Npm.yaml.j2

@@ -26,3 +26,9 @@ configurations:
       url: https://host.docker.internal:{{ 'NPM_REPO_PORT' | env }}/
   rust:
     repositories: []
+  go:
+    repositories: []
+  ruby:
+    repositories: []
+  nuget:
+    repositories: []

tests/configs/NuGet.yaml.j2

@@ -0,0 +1,34 @@
+uuid: 5b3c4d6e-7f80-4192-8b13-4d5e6f708192
+organisation: InterDiode
+description: NuGet test configuration
+configurations:
+  certificates:
+  - name: Test CA
+    content: |
+{{ 'certs/test-ca.crt.pem' | file | indent(6, first=true) }}
+  apt:
+    sources: []
+    keys: []
+  apk:
+    repositories: []
+  yum:
+    repositories: []
+    keys: []
+  python:
+    repositories: []
+  java:
+    repositories: []
+  php:
+    repositories: []
+  npm:
+    repositories: []
+  rust:
+    repositories: []
+  go:
+    repositories: []
+  ruby:
+    repositories: []
+  nuget:
+    repositories:
+    - name: demo
+      url: https://host.docker.internal:{{ 'NUGET_REPO_PORT' | env }}/index.json

tests/configs/Php.yaml.j2

@@ -26,3 +26,9 @@ configurations:
     repositories: []
   rust:
     repositories: []
+  go:
+    repositories: []
+  ruby:
+    repositories: []
+  nuget:
+    repositories: []

tests/configs/Python.yaml.j2

@@ -26,3 +26,9 @@ configurations:
     repositories: []
   rust:
     repositories: []
+  go:
+    repositories: []
+  ruby:
+    repositories: []
+  nuget:
+    repositories: []

tests/configs/Ruby.yaml.j2

@@ -0,0 +1,34 @@
+uuid: 4a2b3c5d-6e7f-4081-9a02-3c4d5e6f7081
+organisation: InterDiode
+description: Ruby test configuration
+configurations:
+  certificates:
+  - name: Test CA
+    content: |
+{{ 'certs/test-ca.crt.pem' | file | indent(6, first=true) }}
+  apt:
+    sources: []
+    keys: []
+  apk:
+    repositories: []
+  yum:
+    repositories: []
+    keys: []
+  python:
+    repositories: []
+  java:
+    repositories: []
+  php:
+    repositories: []
+  npm:
+    repositories: []
+  rust:
+    repositories: []
+  go:
+    repositories: []
+  ruby:
+    repositories:
+    - name: demo
+      url: https://host.docker.internal:{{ 'RUBY_REPO_PORT' | env }}/
+  nuget:
+    repositories: []

tests/configs/Rust.yaml.j2

@@ -26,3 +26,9 @@ configurations:
     repositories:
     - name: demo
       url: https://host.docker.internal:{{ 'CARGO_REPO_PORT' | env }}/
+  go:
+    repositories: []
+  ruby:
+    repositories: []
+  nuget:
+    repositories: []

tests/configs/Yum.yaml.j2

@@ -26,3 +26,9 @@ configurations:
     repositories: []
   rust:
     repositories: []
+  go:
+    repositories: []
+  ruby:
+    repositories: []
+  nuget:
+    repositories: []

tests/dockerfiles/Go.Dockerfile

@@ -0,0 +1,11 @@
+FROM golang:1-bookworm AS target
+FROM interdiode/id-configurator:latest AS configuration
+COPY --from=target / /src/
+COPY --from=generated-config Go.yaml /config.yaml
+RUN id-configurator apply --config /config.yaml --src /src --dst /dst
+FROM target AS runtime
+COPY --from=configuration /dst/ /
+RUN mkdir -p /tmp/gotest && cd /tmp/gotest && go mod init gotest \
+    && go get example.invalid/idconfiguratortestpkg@v0.0.1 \
+    && grep -qx 'test-only module served by the id-configurator integration tests' \
+       "$(find "$(go env GOMODCACHE)" -name marker.txt)"

tests/dockerfiles/NuGet.Dockerfile

@@ -0,0 +1,11 @@
+FROM mcr.microsoft.com/dotnet/sdk:9.0 AS target
+FROM interdiode/id-configurator:latest AS configuration
+COPY --from=target / /src/
+COPY --from=generated-config NuGet.yaml /config.yaml
+RUN id-configurator apply --config /config.yaml --src /src --dst /dst
+FROM target AS runtime
+COPY --from=configuration /dst/ /
+RUN mkdir -p /tmp/nugettest && cd /tmp/nugettest && dotnet new console -o . --no-restore >/dev/null \
+    && dotnet add package idconfiguratortestpkg --version 0.0.1 \
+    && grep -qx 'test-only package served by the id-configurator integration tests' \
+       "$(find /root/.nuget/packages/idconfiguratortestpkg -name marker.txt)"

tests/dockerfiles/Ruby.Dockerfile

@@ -0,0 +1,10 @@
+FROM ruby:3-slim AS target
+FROM interdiode/id-configurator:latest AS configuration
+COPY --from=target / /src/
+COPY --from=generated-config Ruby.yaml /config.yaml
+RUN id-configurator apply --config /config.yaml --src /src --dst /dst
+FROM target AS runtime
+COPY --from=configuration /dst/ /
+RUN gem install idconfiguratortestpkg --no-document \
+    && grep -qx 'test-only gem served by the id-configurator integration tests' \
+       "$(find "$(gem environment gemdir)" -name marker.txt)"

tests/dockerfiles/repos/IdConfiguratorTestPkg.csproj

@@ -0,0 +1,12 @@
+<Project Sdk="Microsoft.NET.Sdk">
+  <PropertyGroup>
+    <TargetFramework>net9.0</TargetFramework>
+    <PackageId>idconfiguratortestpkg</PackageId>
+    <Version>0.0.1</Version>
+    <Authors>InterDiode</Authors>
+    <Description>test-only package served by the id-configurator integration tests</Description>
+  </PropertyGroup>
+  <ItemGroup>
+    <None Include="marker.txt" Pack="true" PackagePath="content/marker.txt" />
+  </ItemGroup>
+</Project>

tests/dockerfiles/repos/build_test_gem.sh

@@ -0,0 +1,32 @@
+#!/bin/sh
+# Build a minimal, hand-rolled RubyGems package and a full gem repository
+# index for it (legacy + compact index formats), for integration-testing
+# the `ruby` module of id-configurator. Uses RubyGems' own `gem build` and
+# `gem generate_index` (the same tools a real gem server host would use)
+# rather than hand-rolling the compact index's binary/marshal formats.
+set -eu
+
+PACKAGE=idconfiguratortestpkg
+VERSION=0.0.1
+MARKER="test-only gem served by the id-configurator integration tests"
+
+gem install rubygems-generate_index --no-document
+
+mkdir -p "/build/${PACKAGE}-${VERSION}"
+cd "/build/${PACKAGE}-${VERSION}"
+cat > "${PACKAGE}.gemspec" <<EOF
+Gem::Specification.new do |s|
+  s.name        = "${PACKAGE}"
+  s.version     = "${VERSION}"
+  s.summary     = "test-only gem"
+  s.authors     = ["InterDiode"]
+  s.license     = "MIT"
+  s.files       = ["marker.txt"]
+end
+EOF
+echo "${MARKER}" > marker.txt
+gem build "${PACKAGE}.gemspec"
+
+mkdir -p /srv/gems
+cp ./*.gem /srv/gems/
+gem generate_index -d /srv

tests/dockerfiles/repos/build_test_go_module.py

@@ -0,0 +1,47 @@
+"""Build a minimal, offline, hand-rolled Go module proxy tree, for
+integration-testing the `go` module of id-configurator.
+
+No network access and no Go toolchain is used: the module proxy protocol
+(https://go.dev/ref/mod#module-proxy) only requires a handful of static
+files, none of which embed the server's own base URL (unlike Composer/
+npm/cargo), so this can be served directly by nginx with no rewriting.
+"""
+
+from __future__ import annotations
+
+import io
+import json
+import pathlib
+import zipfile
+
+MODULE = "example.invalid/idconfiguratortestpkg"
+VERSION = "v0.0.1"
+OUT_DIR = pathlib.Path("/srv")
+MARKER = "test-only module served by the id-configurator integration tests\n"
+
+GO_MOD = f"module {MODULE}\n\ngo 1.21\n"
+
+
+def build_zip() -> bytes:
+    buffer = io.BytesIO()
+    prefix = f"{MODULE}@{VERSION}"
+    with zipfile.ZipFile(buffer, "w") as archive:
+        archive.writestr(f"{prefix}/go.mod", GO_MOD)
+        archive.writestr(f"{prefix}/marker.txt", MARKER)
+    return buffer.getvalue()
+
+
+def main() -> None:
+    module_dir = OUT_DIR / MODULE / "@v"
+    module_dir.mkdir(parents=True, exist_ok=True)
+    (module_dir / "list").write_text(f"{VERSION}\n", encoding="utf-8")
+    (module_dir / f"{VERSION}.info").write_text(
+        json.dumps({"Version": VERSION, "Time": "2024-01-01T00:00:00Z"}),
+        encoding="utf-8",
+    )
+    (module_dir / f"{VERSION}.mod").write_text(GO_MOD, encoding="utf-8")
+    (module_dir / f"{VERSION}.zip").write_bytes(build_zip())
+
+
+if __name__ == "__main__":
+    main()

tests/dockerfiles/repos/build_test_nuget_feed.py

@@ -0,0 +1,61 @@
+"""Build a minimal NuGet v3 static feed around one real, `dotnet pack`-built
+.nupkg, for integration-testing the `nuget` module of id-configurator.
+
+Only two resources are populated: the flat container (`PackageBaseAddress`,
+used to enumerate versions and download the .nupkg directly) and the
+top-level service index pointing at it. `dotnet add package`/`dotnet
+restore` with an explicit, dependency-free package version only ever calls
+these two - never the (considerably more complex) registration resource -
+so it is intentionally not implemented here.
+
+The service index bakes in a __BASE_URL__ placeholder for its "@id" fields,
+since the host:port this fixture is actually reached on is only known once
+tox-docker starts the container, not at image-build time (see
+nuget-repo.nginx.conf). The flat container's own files never embed a URL,
+so they need no such rewriting.
+"""
+
+from __future__ import annotations
+
+import json
+import pathlib
+import shutil
+
+PACKAGE_ID = "idconfiguratortestpkg"
+VERSION = "0.0.1"
+NUPKG_NAME = f"{PACKAGE_ID}.{VERSION}.nupkg"
+NUPKG_SRC = pathlib.Path("/nupkg") / NUPKG_NAME
+OUT_DIR = pathlib.Path("/srv")
+
+
+def write_flat_container() -> None:
+    package_dir = OUT_DIR / "flatcontainer" / PACKAGE_ID
+    version_dir = package_dir / VERSION
+    version_dir.mkdir(parents=True, exist_ok=True)
+    (package_dir / "index.json").write_text(
+        json.dumps({"versions": [VERSION]}), encoding="utf-8"
+    )
+    shutil.copy(NUPKG_SRC, version_dir / NUPKG_NAME)
+
+
+def write_service_index() -> None:
+    index = {
+        "version": "3.0.0",
+        "resources": [
+            {
+                "@id": "__BASE_URL__/flatcontainer/",
+                "@type": "PackageBaseAddress/3.0.0",
+            }
+        ],
+    }
+    (OUT_DIR / "index.json").write_text(json.dumps(index), encoding="utf-8")
+
+
+def main() -> None:
+    OUT_DIR.mkdir(parents=True, exist_ok=True)
+    write_flat_container()
+    write_service_index()
+
+
+if __name__ == "__main__":
+    main()

tests/dockerfiles/repos/go-repo.Dockerfile

@@ -0,0 +1,17 @@
+# Minimal Go module proxy serving one hand-built module over TLS, using the
+# same Test CA as the other *-repo fixtures, used by tox-docker to exercise
+# the `go` module integration test (tests/configs/Go.yaml.j2,
+# tests/dockerfiles/Go.Dockerfile).
+#
+# Built by tox-docker, whose build context is this directory (not the repo
+# root) - every COPY source below must live under tests/dockerfiles/repos/.
+FROM python:3.13-slim AS packagebuild
+COPY build_test_go_module.py /build_test_go_module.py
+RUN python3 /build_test_go_module.py
+
+FROM nginx:alpine
+COPY --from=packagebuild /srv /srv
+COPY repo-server.crt.pem /etc/nginx/certs/repo-server.crt.pem
+COPY repo-server.key.pem /etc/nginx/certs/repo-server.key.pem
+COPY go-repo.nginx.conf /etc/nginx/conf.d/default.conf
+EXPOSE 8443

tests/dockerfiles/repos/go-repo.nginx.conf

@@ -0,0 +1,10 @@
+server {
+    listen 8443 ssl default_server;
+    server_name _;
+
+    ssl_certificate     /etc/nginx/certs/repo-server.crt.pem;
+    ssl_certificate_key /etc/nginx/certs/repo-server.key.pem;
+
+    root /srv;
+    autoindex off;
+}

tests/dockerfiles/repos/nuget-repo.Dockerfile

@@ -0,0 +1,23 @@
+# Minimal NuGet v3 static feed serving one real, dotnet-packed .nupkg over
+# TLS, using the same Test CA as the other *-repo fixtures, used by
+# tox-docker to exercise the `nuget` module integration test
+# (tests/configs/NuGet.yaml.j2, tests/dockerfiles/NuGet.Dockerfile).
+#
+# Built by tox-docker, whose build context is this directory (not the repo
+# root) - every COPY source below must live under tests/dockerfiles/repos/.
+FROM mcr.microsoft.com/dotnet/sdk:9.0 AS packagebuild
+COPY IdConfiguratorTestPkg.csproj /pkgsrc/IdConfiguratorTestPkg.csproj
+RUN echo 'test-only package served by the id-configurator integration tests' > /pkgsrc/marker.txt \
+    && dotnet pack /pkgsrc -c Release -o /nupkg
+
+FROM python:3.13-slim AS feedbuild
+COPY --from=packagebuild /nupkg /nupkg
+COPY build_test_nuget_feed.py /build_test_nuget_feed.py
+RUN python3 /build_test_nuget_feed.py
+
+FROM nginx:alpine
+COPY --from=feedbuild /srv /srv
+COPY repo-server.crt.pem /etc/nginx/certs/repo-server.crt.pem
+COPY repo-server.key.pem /etc/nginx/certs/repo-server.key.pem
+COPY nuget-repo.nginx.conf /etc/nginx/conf.d/default.conf
+EXPOSE 8443

tests/dockerfiles/repos/nuget-repo.nginx.conf

@@ -0,0 +1,22 @@
+server {
+    listen 8443 ssl default_server;
+    server_name _;
+
+    ssl_certificate     /etc/nginx/certs/repo-server.crt.pem;
+    ssl_certificate_key /etc/nginx/certs/repo-server.key.pem;
+
+    root /srv;
+    autoindex off;
+
+    # The service index bakes in a __BASE_URL__ placeholder for its "@id"
+    # fields, since the host:port this fixture is actually reached on is
+    # only known once tox-docker starts the container, not at image-build
+    # time. $http_host reflects exactly what the client (nuget) used to
+    # connect, e.g. host.docker.internal:55123.
+    location = /index.json {
+        default_type application/json;
+        sub_filter '__BASE_URL__' 'https://$http_host';
+        sub_filter_once off;
+        sub_filter_types application/json;
+    }
+}

tests/dockerfiles/repos/ruby-repo.Dockerfile

@@ -0,0 +1,17 @@
+# Minimal RubyGems repository serving one hand-built gem over TLS, using the
+# same Test CA as the other *-repo fixtures, used by tox-docker to exercise
+# the `ruby` module integration test (tests/configs/Ruby.yaml.j2,
+# tests/dockerfiles/Ruby.Dockerfile).
+#
+# Built by tox-docker, whose build context is this directory (not the repo
+# root) - every COPY source below must live under tests/dockerfiles/repos/.
+FROM ruby:3-slim AS packagebuild
+COPY build_test_gem.sh /build_test_gem.sh
+RUN sh /build_test_gem.sh
+
+FROM nginx:alpine
+COPY --from=packagebuild /srv /srv
+COPY repo-server.crt.pem /etc/nginx/certs/repo-server.crt.pem
+COPY repo-server.key.pem /etc/nginx/certs/repo-server.key.pem
+COPY ruby-repo.nginx.conf /etc/nginx/conf.d/default.conf
+EXPOSE 8443

tests/dockerfiles/repos/ruby-repo.nginx.conf

@@ -0,0 +1,10 @@
+server {
+    listen 8443 ssl default_server;
+    server_name _;
+
+    ssl_certificate     /etc/nginx/certs/repo-server.crt.pem;
+    ssl_certificate_key /etc/nginx/certs/repo-server.key.pem;
+
+    root /srv;
+    autoindex off;
+}

tests/test_cli.py

@@ -43,10 +43,13 @@ def test_list_modules() -> None:
         "apk",
         "apt",
         "certificates",
+        "go",
         "java",
         "npm",
+        "nuget",
         "php",
         "python",
+        "ruby",
         "rust",
         "yum",
     }

tests/test_go.py

@@ -0,0 +1,67 @@
+from id_configurator.config import Configuration
+from id_configurator.context import Context
+from id_configurator.modules.go import GoModule
+
+CONFIG_WITH_REPO = {
+    "uuid": "12345678-1234-5678-1234-567812345678",
+    "organisation": "InterDiode",
+    "configurations": {
+        "go": {"repositories": [{"name": "demo", "url": "https://example.invalid/"}]}
+    },
+}
+
+CONFIG_WITH_TWO_REPOS = {
+    "uuid": "12345678-1234-5678-1234-567812345678",
+    "organisation": "InterDiode",
+    "configurations": {
+        "go": {
+            "repositories": [
+                {"name": "demo", "url": "https://example.invalid/"},
+                {"name": "other", "url": "https://other.invalid/"},
+            ]
+        }
+    },
+}
+
+EMPTY_CONFIG = {
+    "uuid": "12345678-1234-5678-1234-567812345678",
+    "organisation": "InterDiode",
+}
+
+
+def make_config(data: dict) -> Configuration:
+    return Configuration.model_validate(data)
+
+
+def test_is_relevant_false_when_no_repositories(tmp_path) -> None:
+    context = Context(config=make_config(EMPTY_CONFIG), dst=tmp_path / "dst", src=None)
+    assert GoModule().is_relevant(context) is False
+
+
+def test_is_relevant_true_with_repository(tmp_path) -> None:
+    context = Context(
+        config=make_config(CONFIG_WITH_REPO), dst=tmp_path / "dst", src=None
+    )
+    assert GoModule().is_relevant(context) is True
+
+
+def test_apply_writes_goproxy(tmp_path) -> None:
+    dst = tmp_path / "dst"
+    context = Context(config=make_config(CONFIG_WITH_REPO), dst=dst, src=None)
+
+    GoModule().apply(context)
+
+    go_env = (dst / "usr/local/go/go.env").read_text(encoding="utf-8")
+    assert go_env == "GOPROXY=https://example.invalid/\nGOSUMDB=off\n"
+
+
+def test_apply_joins_multiple_repositories_with_comma(tmp_path) -> None:
+    dst = tmp_path / "dst"
+    context = Context(config=make_config(CONFIG_WITH_TWO_REPOS), dst=dst, src=None)
+
+    GoModule().apply(context)
+
+    go_env = (dst / "usr/local/go/go.env").read_text(encoding="utf-8")
+    assert go_env == (
+        "GOPROXY=https://example.invalid/,https://other.invalid/\nGOSUMDB=off\n"
+    )

tests/test_nuget.py

@@ -0,0 +1,82 @@
+from id_configurator.config import Configuration
+from id_configurator.context import Context
+from id_configurator.modules.nuget import NuGetModule
+
+CONFIG_WITH_REPO = {
+    "uuid": "12345678-1234-5678-1234-567812345678",
+    "organisation": "InterDiode",
+    "configurations": {
+        "nuget": {"repositories": [{"name": "demo", "url": "https://example.invalid/"}]}
+    },
+}
+
+CONFIG_WITH_TWO_REPOS = {
+    "uuid": "12345678-1234-5678-1234-567812345678",
+    "organisation": "InterDiode",
+    "configurations": {
+        "nuget": {
+            "repositories": [
+                {"name": "demo", "url": "https://example.invalid/"},
+                {"name": "other", "url": "https://other.invalid/"},
+            ]
+        }
+    },
+}
+
+EMPTY_CONFIG = {
+    "uuid": "12345678-1234-5678-1234-567812345678",
+    "organisation": "InterDiode",
+}
+
+
+def make_config(data: dict) -> Configuration:
+    return Configuration.model_validate(data)
+
+
+def test_is_relevant_false_when_no_repositories(tmp_path) -> None:
+    context = Context(config=make_config(EMPTY_CONFIG), dst=tmp_path / "dst", src=None)
+    assert NuGetModule().is_relevant(context) is False
+
+
+def test_is_relevant_true_with_repository(tmp_path) -> None:
+    context = Context(
+        config=make_config(CONFIG_WITH_REPO), dst=tmp_path / "dst", src=None
+    )
+    assert NuGetModule().is_relevant(context) is True
+
+
+def test_apply_writes_nuget_config(tmp_path) -> None:
+    dst = tmp_path / "dst"
+    context = Context(config=make_config(CONFIG_WITH_REPO), dst=dst, src=None)
+
+    NuGetModule().apply(context)
+
+    content = (dst / "root/.nuget/NuGet/NuGet.Config").read_text(encoding="utf-8")
+    assert content == (
+        '<?xml version="1.0" encoding="utf-8"?>\n'
+        "<configuration>\n"
+        "  <packageSources>\n"
+        "    <clear />\n"
+        '    <add key="demo" value="https://example.invalid/" />\n'
+        "  </packageSources>\n"
+        "</configuration>\n"
+    )
+
+
+def test_apply_writes_multiple_sources_in_order(tmp_path) -> None:
+    dst = tmp_path / "dst"
+    context = Context(config=make_config(CONFIG_WITH_TWO_REPOS), dst=dst, src=None)
+
+    NuGetModule().apply(context)
+
+    content = (dst / "root/.nuget/NuGet/NuGet.Config").read_text(encoding="utf-8")
+    assert content == (
+        '<?xml version="1.0" encoding="utf-8"?>\n'
+        "<configuration>\n"
+        "  <packageSources>\n"
+        "    <clear />\n"
+        '    <add key="demo" value="https://example.invalid/" />\n'
+        '    <add key="other" value="https://other.invalid/" />\n'
+        "  </packageSources>\n"
+        "</configuration>\n"
+    )

tests/test_ruby.py

@@ -0,0 +1,67 @@
+from id_configurator.config import Configuration
+from id_configurator.context import Context
+from id_configurator.modules.ruby import RubyModule
+
+CONFIG_WITH_REPO = {
+    "uuid": "12345678-1234-5678-1234-567812345678",
+    "organisation": "InterDiode",
+    "configurations": {
+        "ruby": {"repositories": [{"name": "demo", "url": "https://example.invalid/"}]}
+    },
+}
+
+CONFIG_WITH_TWO_REPOS = {
+    "uuid": "12345678-1234-5678-1234-567812345678",
+    "organisation": "InterDiode",
+    "configurations": {
+        "ruby": {
+            "repositories": [
+                {"name": "demo", "url": "https://example.invalid/"},
+                {"name": "other", "url": "https://other.invalid/"},
+            ]
+        }
+    },
+}
+
+EMPTY_CONFIG = {
+    "uuid": "12345678-1234-5678-1234-567812345678",
+    "organisation": "InterDiode",
+}
+
+
+def make_config(data: dict) -> Configuration:
+    return Configuration.model_validate(data)
+
+
+def test_is_relevant_false_when_no_repositories(tmp_path) -> None:
+    context = Context(config=make_config(EMPTY_CONFIG), dst=tmp_path / "dst", src=None)
+    assert RubyModule().is_relevant(context) is False
+
+
+def test_is_relevant_true_with_repository(tmp_path) -> None:
+    context = Context(
+        config=make_config(CONFIG_WITH_REPO), dst=tmp_path / "dst", src=None
+    )
+    assert RubyModule().is_relevant(context) is True
+
+
+def test_apply_writes_gemrc(tmp_path) -> None:
+    dst = tmp_path / "dst"
+    context = Context(config=make_config(CONFIG_WITH_REPO), dst=dst, src=None)
+
+    RubyModule().apply(context)
+
+    expected = ":sources:\n- https://example.invalid/\n"
+    assert (dst / "usr/local/etc/gemrc").read_text(encoding="utf-8") == expected
+    assert (dst / "etc/gemrc").read_text(encoding="utf-8") == expected
+
+
+def test_apply_writes_multiple_sources_in_order(tmp_path) -> None:
+    dst = tmp_path / "dst"
+    context = Context(config=make_config(CONFIG_WITH_TWO_REPOS), dst=dst, src=None)
+
+    RubyModule().apply(context)
+
+    expected = ":sources:\n- https://example.invalid/\n- https://other.invalid/\n"
+    assert (dst / "usr/local/etc/gemrc").read_text(encoding="utf-8") == expected
+    assert (dst / "etc/gemrc").read_text(encoding="utf-8") == expected