Skip to content

Add RubyGems trusted publishing - #336

Merged
StephenWakely merged 7 commits into
masterfrom
lloeki/trusted-publishing
Nov 9, 2026
Merged

StephenWakely merged 7 commits into
masterfrom
lloeki/trusted-publishing

Conversation

@lloeki

@lloeki lloeki commented Oct 30, 2026 •

Copy link
Copy Markdown
Member

Summary

  • Add a manually dispatched Publish workflow based on libdatadog-rb.
  • Restrict publishing to master and the rubygems.org environment.
  • Run the specs, then use rubygems/release-gem and the existing Bundler release task to build, tag, and publish the gem.
  • Create a GitHub release for the same tag, with generated release notes and the built gem attached.
  • Add the Octo STS policy for release tag pushes and document the release procedure.
  • Update CI for the Windows certificate path and Bundler 4, and add Ruby 4.0 coverage.

Validation

  • Ruby 3.4 and 4.0: 660 examples, zero failures, 15 pending locally.
  • Gem build passed.
  • Workflow linting with actionlint and ShellCheck passed.
  • Verified that the GitHub release tag and asset filename match the gemspec version.
  • No release was published during validation.

Base the manual publishing workflow on `libdatadog-rb`, using
`rubygems/release-gem` and the existing Bundler release task.

Restrict publishing to `master` through the `rubygems.org` environment.
Use OIDC for RubyGems credentials and Octo STS for release tag pushes,
so publishing needs no long-lived API keys. Document publisher setup
and the release procedure.
@lloeki
lloeki requested a review from a team as a code owner October 30, 2026 14:44
@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 30, 2026 •

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-10-30T14:46:38.705188Z 1d5edbd PR opened
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

Update `ruby/setup-ruby` to v1.335.0, which also searches Git’s
`ucrt64` certificate directory. The previous pin only checked the
`mingw64` paths, failing during DevKit setup for Ruby 2.1–2.3.
Let `ruby/setup-ruby` install dependencies through `bundler-cache`.
The redundant install step uses `--with`, which Bundler 4 removed.
Development dependencies are included by default.

Quote Ruby matrix versions so `3.0` remains a minor version rather
than becoming `3` and selecting the latest Ruby 3 release.
Add Ruby 4.0 to the Linux, macOS, and Windows test matrix.
Declare `logger` and `irb` as test dependencies on Ruby 4.0 and newer,
where they are no longer default gems.
Reline requires `fiddle/import` for its Windows backend when FakeFS
loads IRB. Declare `fiddle` alongside the other former default gems
so the Ruby 4.0 Windows suite can load.

@StephenWakely StephenWakely left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Presumably we want to still create GitHub releases when releasing as well. Would it be possible to either add a release task to the workflow or include the details in RELEASING.md?

Create a GitHub release after publishing to RubyGems, using the
same version tag and the gem built by the release task. Require
the tag to exist so release creation cannot tag a different commit.

Generate release notes and document the GitHub release output.
@lloeki

lloeki commented Nov 6, 2026

Copy link
Copy Markdown
Member Author

Addressed by 74b7f64

@StephenWakely StephenWakely left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you.

@StephenWakely
StephenWakely merged commit 1993c22 into master Nov 9, 2026
37 checks passed
@StephenWakely
StephenWakely deleted the lloeki/trusted-publishing branch November 9, 2026 11:11
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants