Add RubyGems trusted publishing release workflow - #129
Merged
Conversation
RubyGems.org expired all legacy API keys after a CDN caching bug (GHSA-9j48-x3c3-mrp2) could replay one account's key to another request for up to an hour. Rather than storing a fresh long-lived API key on a maintainer's machine, add a tag-triggered GitHub Actions workflow that publishes to RubyGems.org via OIDC trusted publishing, so no RubyGems credential needs to be held anywhere. The existing `rake gem:push` task (which also pushes to GitHub Packages) remains available as a manual fallback. Requires a Trusted Publisher to be configured for the `rubytree` gem at rubygems.org, pointing at this repository and workflow file.
Tag-push triggers in GitHub Actions can't be filtered by branch directly, so a release tag pushed from any branch would still fire the publish workflow. Add a step that verifies the tagged commit is reachable from origin/master and fails before the build/publish steps run if it isn't, so an accidental tag elsewhere can't trigger a release.
|
coverage: 96.35%. remained the same — features/trusted-publishing into master |
4 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
.github/workflows/release.yml, a tag-triggered (R*) workflow that publishesrubytreeto RubyGems.org using trusted publishing (OIDC) instead of a stored API keymaster, since tag-push triggers can't be scoped to a branch directlyContext
RubyGems.org expired all legacy API keys after a CDN caching bug (GHSA-9j48-x3c3-mrp2) could replay one account's key to another request for up to an hour. This removes the need to store a long-lived RubyGems API key anywhere for future releases. A Trusted Publisher for
evolve75/RubyTree/release.ymlhas already been configured on rubygems.org. The existingrake gem:pushtask (which also pushes to GitHub Packages) remains as a manual fallback.Test plan
rake test:allpasses on this branchrake gem:packagebuilds the gem successfullyR*tag does)