## Background The Artifact Registry Ruby client (S02) was originally implemented as a gem under `ee/gems/gitlab-artifact_registry-client`: - Step 1 (foundation + repository fetch): https://gitlab.com/gitlab-org/gitlab/-/merge_requests/246861 - Step 2 (repository listing + pagination): https://gitlab.com/gitlab-org/gitlab/-/merge_requests/247309 - Step 3 (write methods): https://gitlab.com/gitlab-org/gitlab/-/merge_requests/247315 The gem track was closed on 2026-07-31 and the client landed as plain `ee/lib/artifact_registry/` code instead: - Step 1: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/244245 - Steps 2+3 (combined): https://gitlab.com/gitlab-org/gitlab/-/merge_requests/245331 - S03 GraphQL foundation on top: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/248067 Two constraints forced the pivot: 1. **Legal ruling: the client must be EE-licensed.** Confirmed by legal on the gem MR: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/246861#note_3629413100 (initial assessment in https://gitlab.com/gitlab-org/gitlab/-/merge_requests/246861#note_3624027684). This rules out the MIT + `gems//vendor/gems` placement used by precedents like `gitlab-duo-workflow-service-client`. 2. **An EE-licensed gem under `ee/gems/` with a `path:` source breaks gitlab-foss.** `install_if` correctly gates install/runtime, but Bundler registers the `path:` source unconditionally, so the shared `Gemfile.lock` requires `ee/gems/` to exist for any re-resolution. Verified against a FOSS-like tree (no `ee/`): `bundle install`/`check`/`exec` and frozen installs pass, but `bundle lock --add-platform`, `bundle cache --all-platforms`, `bundle update`, `bundle outdated`, and any resolve after a Gemfile change all fail with `Bundler::PathError` (exit 13). On gitlab-foss master this makes both the `backup gems` job (`bundle package --all-platforms`) and `static-analysis` (`scripts/license-check.sh` runs `bundle lock --add-platform`) go red after FOSS sync. Raised by @tkuah in https://gitlab.com/gitlab-org/gitlab/-/merge_requests/246861#note_3621704383. ## Proposal Extract the client back out of `ee/lib` into an EE-licensed gem, using the packaging approach that was validated during the investigation: **Keep the `Nonstandard` (EE) license, publish the gem to rubygems.org, keep `install_if`, and drop the `path:` source.** This combination was tested against the same FOSS-like tree and passes every previously failing command: the gem is locked but never installed on FOSS, and fresh resolves, `bundle update`, `bundle cache --all-platforms`, and `bundle lock --add-platform` all succeed without `ee/`. Known cost: the development loop needs a version bump + publish per change while the client is still evolving. Mitigable with `bundle config local.<gem> <path>`. This is a large part of why the extraction is deferred until the client API stabilizes (S02/S03 landed and settled). Approaches ruled out during the investigation: - MIT relicense + move to `gems/` or `vendor/gems/`: blocked by the legal ruling above. - Split `Gemfile.ee`/separate lockfile: open handbook question (library extraction), too large in scope. - Patching individual FOSS CI jobs: whack-a-mole, and local FOSS development stays broken. - `git:` source: the monolith has zero and policy discourages it. - Gemspec stubs in the FOSS sync: violates the sync invariant. ## Existing work to reuse - The closed gem MRs above contain a complete, maintainer-approved implementation (all approvals were in and the pipeline was green on https://gitlab.com/gitlab-org/gitlab/-/merge_requests/246861 before the legal decision closed it), including the gemspec, `install_if` wiring, and specs. - `config/dependency_decisions.yml` needs an `:approve` entry for the `Nonstandard` license (the monolith LicenseFinder gate), and omnibus needs the equivalent entry in `support/dependency_decisions.yml` (previously done in https://gitlab.com/gitlab-org/omnibus-gitlab/-/merge_requests/9627). - Known CI/tooling gaps for a first `ee/gems/` gem: the `validate-gem` and `validate-gemfile-lock` jobs skip the `ee/gems/` prefix, and the parent-exclusion ERB guard in `gems/config/rubocop.yml` needs care (RuboCop evaluates config ERB relative to the config file's directory). - The gem name `gitlab-artifact_registry-client` still needs to be reserved on rubygems.org before publishing. - `doc/development/gems.md` follow-up: document that new `ee/gems/` gems need the omnibus license allowlist entry. ## Acceptance criteria - [ ] Client code moved from `ee/lib/artifact_registry/` into an EE-licensed gem, published to rubygems.org, referenced from the Gemfile via `install_if` without a `path:` source - [ ] gitlab-foss master stays green after FOSS sync (`backup gems` and `static-analysis` jobs verified) - [ ] License gates satisfied in both the monolith and omnibus dependency decisions files - [ ] Development workflow for iterating on the gem locally documented (for example `bundle config local.<gem>`)