Merge branch 'mattmi/pin-cookbook-publisher-ruby-version' into 'main'

Always use ruby 2.7 when publishing.

See merge request gitlab-com/gl-infra/common-ci-tasks!876

templates/chef.yml

@@ -43,6 +43,8 @@ variables:
   BUNDLE_PATH: "$CI_PROJECT_DIR/.bundle"
   RUBYOPT: "-W0" # Disable ruby warnings.
   EXTRA_PRODUCTS_FILE: cinc-products.rb
+  COOKBOOK_PUBLISHER_BRANCH: "master"
+  COOKBOOK_PUBLISHER_SKIP_VERSION_CHECK: "false"
 before_script:
   - eval $(ssh-agent -s)
@@ -53,7 +55,8 @@ before_script:
   - bundle config set clean 'true'
   - bundle config set path $BUNDLE_PATH
   - bundle config build.ffi-yajl --withh-ldflags="-Wl,-undefined,dynamic_lookup"
-  - bundle install --jobs "$(nproc)"
+  # Skip the initial bundle when publishing. We bundle using cookbook-publisher's lockfile later.
+  - if [[ "$CI_JOB_NAME" != "push-cookbook" ]]; then bundle install --jobs "$(nproc)" ; fi
 kitchen-suites-updated?:
   stage: $[[ inputs.lint_stage ]]
@@ -113,6 +116,7 @@ kitchen:
 push-cookbook:
   stage: $[[ inputs.publish_stage ]]
+  image: ruby:2.7
   only:
     refs:
       - master
@@ -122,8 +126,7 @@ push-cookbook:
       - "$OPS_CLONE_PASSWORD"
   script:
     - rm -rf Gemfile Gemfile.lock || true
-    - git clone https://$OPS_CLONE_USERNAME:$OPS_CLONE_PASSWORD@ops.gitlab.net/gitlab-cookbooks/cookbook-publisher.git /tmp/cookbook-publisher
+    - git clone -b "$COOKBOOK_PUBLISHER_BRANCH" https://$OPS_CLONE_USERNAME:$OPS_CLONE_PASSWORD@ops.gitlab.net/gitlab-cookbooks/cookbook-publisher.git /tmp/cookbook-publisher
     - cp /tmp/cookbook-publisher/publisher.rb /tmp/cookbook-publisher/Gemfile /tmp/cookbook-publisher/Gemfile.lock .
-    - if [[ "$(ruby -v | awk '{print $2}')" =~ ^2 ]]; then echo "Using cookbook-publisher lockfile" ; else rm Gemfile.lock ; fi
     - bundle install
     - bundle exec ruby publisher.rb