Skip to content

Add RubyGems trusted publishing - #336

Open
lloeki wants to merge 6 commits into
masterfrom
lloeki/trusted-publishing
Open

lloeki wants to merge 6 commits into
masterfrom
lloeki/trusted-publishing

Conversation

@lloeki

@lloeki lloeki commented Oct 30, 2026

Copy link
Copy Markdown
Member

Summary

  • Add a manually dispatched Publish workflow based on libdatadog-rb.
  • Restrict publishing to master and the rubygems.org environment.
  • Run the specs, then use rubygems/release-gem and the existing Bundler release task to build, tag, and publish the gem.
  • Add the Octo STS policy for release tag pushes and document the release procedure.

Validation

  • Ruby 3.4: 660 examples, zero failures, 15 pending.
  • Gem build passed.
  • Workflow linting with actionlint and ShellCheck passed.
  • No release was published during validation.

Base the manual publishing workflow on `libdatadog-rb`, using
`rubygems/release-gem` and the existing Bundler release task.

Restrict publishing to `master` through the `rubygems.org` environment.
Use OIDC for RubyGems credentials and Octo STS for release tag pushes,
so publishing needs no long-lived API keys. Document publisher setup
and the release procedure.
@lloeki
lloeki requested a review from a team as a code owner October 30, 2026 14:44
@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 30, 2026 •

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-10-30T14:46:38.705188Z 1d5edbd PR opened
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

Update `ruby/setup-ruby` to v1.335.0, which also searches Git’s
`ucrt64` certificate directory. The previous pin only checked the
`mingw64` paths, failing during DevKit setup for Ruby 2.1–2.3.
Let `ruby/setup-ruby` install dependencies through `bundler-cache`.
The redundant install step uses `--with`, which Bundler 4 removed.
Development dependencies are included by default.

Quote Ruby matrix versions so `3.0` remains a minor version rather
than becoming `3` and selecting the latest Ruby 3 release.
Add Ruby 4.0 to the Linux, macOS, and Windows test matrix.
Declare `logger` and `irb` as test dependencies on Ruby 4.0 and newer,
where they are no longer default gems.
Reline requires `fiddle/import` for its Windows backend when FakeFS
loads IRB. Declare `fiddle` alongside the other former default gems
so the Ruby 4.0 Windows suite can load.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant