From 073e3e6ecd1f71de7c5fd4e8f8acc2f6ebecaa0d Mon Sep 17 00:00:00 2001 From: Loic Nageleisen Date: Thu, 29 Oct 2026 17:03:08 +0100 Subject: [PATCH 1/6] Add RubyGems trusted publishing Base the manual publishing workflow on `libdatadog-rb`, using `rubygems/release-gem` and the existing Bundler release task. Restrict publishing to `master` through the `rubygems.org` environment. Use OIDC for RubyGems credentials and Octo STS for release tag pushes, so publishing needs no long-lived API keys. Document publisher setup and the release procedure. --- .github/chainguard/self.publish.sts.yaml | 13 +++++++++ .github/workflows/publish.yml | 36 ++++++++++++++++++++++++ RELEASING.md | 36 ++++++++++++++++++++++++ 3 files changed, 85 insertions(+) create mode 100644 .github/chainguard/self.publish.sts.yaml create mode 100644 .github/workflows/publish.yml create mode 100644 RELEASING.md diff --git a/.github/chainguard/self.publish.sts.yaml b/.github/chainguard/self.publish.sts.yaml new file mode 100644 index 0000000..5529206 --- /dev/null +++ b/.github/chainguard/self.publish.sts.yaml @@ -0,0 +1,13 @@ +issuer: https://token.actions.githubusercontent.com + +subject: repo:DataDog/dogstatsd-ruby:environment:rubygems.org + +claim_pattern: + event_name: workflow_dispatch + environment: rubygems.org + ref: refs/heads/master + repository: DataDog/dogstatsd-ruby + job_workflow_ref: DataDog/dogstatsd-ruby/\.github/workflows/publish\.yml@refs/heads/master + +permissions: + contents: write diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml new file mode 100644 index 0000000..8323599 --- /dev/null +++ b/.github/workflows/publish.yml @@ -0,0 +1,36 @@ +name: Publish + +on: workflow_dispatch + +permissions: {} + +concurrency: publish + +jobs: + publish: + name: Build and push gem to RubyGems.org + if: github.repository == 'DataDog/dogstatsd-ruby' && github.ref == 'refs/heads/master' + runs-on: ubuntu-24.04 + environment: rubygems.org + permissions: + contents: read + id-token: write # RubyGems trusted publishing and Octo STS + steps: + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false + - name: Set up Ruby + uses: ruby/setup-ruby@afeafc3d1ab54a631816aba4c914a0081c12ff2f # v1.310.0 + with: + ruby-version: '3.4' + bundler-cache: true + - name: Run tests + run: bundle exec rake spec + - uses: DataDog/dd-octo-sts-action@96a25462dbcb10ebf0bfd6e2ccc917d2ab235b9a # v1.0.4 + id: octo-sts + with: + scope: DataDog/dogstatsd-ruby + policy: self.publish + - uses: rubygems/release-gem@6317d8d1f7e28c24d28f6eff169ea854948bd9f7 # v1.2.0 + with: + token: ${{ steps.octo-sts.outputs.token }} diff --git a/RELEASING.md b/RELEASING.md new file mode 100644 index 0000000..ac55e4b --- /dev/null +++ b/RELEASING.md @@ -0,0 +1,36 @@ +# Releasing dogstatsd-ruby + +Releases use the manually triggered [Publish workflow](https://github.com/DataDog/dogstatsd-ruby/actions/workflows/publish.yml) +on `master`, following the trusted-publishing flow in +[libdatadog-rb](https://github.com/DataDog/libdatadog-rb/blob/main/.github/workflows/build.yml). +RubyGems authentication uses short-lived OIDC credentials rather than a stored API key. + +## Publisher configuration + +Register a [trusted publisher](https://guides.rubygems.org/trusted-publishing/adding-a-publisher/) +for the `dogstatsd-ruby` gem on RubyGems.org with: + +- Repository owner: `DataDog` +- Repository name: `dogstatsd-ruby` +- Workflow filename: `publish.yml` +- Environment: `rubygems.org` + +The GitHub `rubygems.org` environment must allow deployments from `master` +and require release approval. The Octo STS `self.publish` policy grants the +publish job a short-lived GitHub token to push the release tag. Its GitHub App +must have permission to create tags under the repository's tag protection rules. + +## Release procedure + +1. Update `lib/datadog/statsd/version.rb` and `CHANGELOG.md`, and merge the + release changes into `master`. +2. Confirm that the Ruby Test workflow passes for the release commit. +3. Run the Publish workflow, selecting `master`, and approve its deployment + to the `rubygems.org` environment. +4. Confirm that the workflow succeeds and the version is available on + [RubyGems.org](https://rubygems.org/gems/dogstatsd-ruby). + +The workflow runs the specs, then invokes `rubygems/release-gem` using the +existing Bundler `release` task. It builds the gem, creates and pushes its +`v` tag, publishes it with Sigstore provenance, and waits for it to +be available on RubyGems.org. Do not create the release tag beforehand. From 1d5edbda3558bdf97a4b2a02f5fabf5880f08353 Mon Sep 17 00:00:00 2001 From: Loic Nageleisen Date: Thu, 29 Oct 2026 17:32:42 +0100 Subject: [PATCH 2/6] Trim release documentation --- RELEASING.md | 19 +------------------ 1 file changed, 1 insertion(+), 18 deletions(-) diff --git a/RELEASING.md b/RELEASING.md index ac55e4b..98a8a78 100644 --- a/RELEASING.md +++ b/RELEASING.md @@ -1,24 +1,7 @@ # Releasing dogstatsd-ruby Releases use the manually triggered [Publish workflow](https://github.com/DataDog/dogstatsd-ruby/actions/workflows/publish.yml) -on `master`, following the trusted-publishing flow in -[libdatadog-rb](https://github.com/DataDog/libdatadog-rb/blob/main/.github/workflows/build.yml). -RubyGems authentication uses short-lived OIDC credentials rather than a stored API key. - -## Publisher configuration - -Register a [trusted publisher](https://guides.rubygems.org/trusted-publishing/adding-a-publisher/) -for the `dogstatsd-ruby` gem on RubyGems.org with: - -- Repository owner: `DataDog` -- Repository name: `dogstatsd-ruby` -- Workflow filename: `publish.yml` -- Environment: `rubygems.org` - -The GitHub `rubygems.org` environment must allow deployments from `master` -and require release approval. The Octo STS `self.publish` policy grants the -publish job a short-lived GitHub token to push the release tag. Its GitHub App -must have permission to create tags under the repository's tag protection rules. +on `master`. ## Release procedure From 5236cb035444d389322ca5d229faa647410408c3 Mon Sep 17 00:00:00 2001 From: Loic Nageleisen Date: Fri, 30 Oct 2026 16:15:53 +0100 Subject: [PATCH 3/6] Fix certificate lookup for old Rubies on Windows MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Update `ruby/setup-ruby` to v1.335.0, which also searches Git’s `ucrt64` certificate directory. The previous pin only checked the `mingw64` paths, failing during DevKit setup for Ruby 2.1–2.3. --- .github/workflows/test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index c47f039..f8942a6 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -31,7 +31,7 @@ jobs: uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0 - name: Set up Ruby - uses: ruby/setup-ruby@ab177d40ee5483edb974554986f56b33477e21d0 # v1.265.0 + uses: ruby/setup-ruby@7f797815d8adceb1c412e7abefdd1ab4abc47a5f # v1.335.0 with: ruby-version: ${{ matrix.ruby }} bundler-cache: true From 788de76688fbd6386a1cdefabbe2e7eef4b733bd Mon Sep 17 00:00:00 2001 From: Loic Nageleisen Date: Fri, 30 Oct 2026 17:09:00 +0100 Subject: [PATCH 4/6] Fix Bundler 4 compatibility in CI Let `ruby/setup-ruby` install dependencies through `bundler-cache`. The redundant install step uses `--with`, which Bundler 4 removed. Development dependencies are included by default. Quote Ruby matrix versions so `3.0` remains a minor version rather than becoming `3` and selecting the latest Ruby 3 release. --- .github/workflows/test.yml | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index f8942a6..2217020 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -17,7 +17,7 @@ jobs: fail-fast: false matrix: os: [ubuntu-latest, macos-latest, windows-latest] - ruby: [2.1, 2.2, 2.3, 2.4, 2.5, 2.6, 2.7, 3.0, 3.1, 3.2, 3.3, 3.4] + ruby: ['2.1', '2.2', '2.3', '2.4', '2.5', '2.6', '2.7', '3.0', '3.1', '3.2', '3.3', '3.4'] exclude: # CRuby < 2.6 does not support macos-arm64. - { os: macos-latest, ruby: '2.1' } @@ -36,8 +36,5 @@ jobs: ruby-version: ${{ matrix.ruby }} bundler-cache: true - - name: Install dependencies - run: bundle install --with development - - name: Run tests run: bundle exec rake spec From 79491ee71d427e46914518df4d8ff1a10c0cd32d Mon Sep 17 00:00:00 2001 From: Loic Nageleisen Date: Fri, 30 Oct 2026 17:11:59 +0100 Subject: [PATCH 5/6] Test Ruby 4.0 in CI Add Ruby 4.0 to the Linux, macOS, and Windows test matrix. Declare `logger` and `irb` as test dependencies on Ruby 4.0 and newer, where they are no longer default gems. --- .github/workflows/test.yml | 2 +- Gemfile | 5 +++++ 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 2217020..626e47c 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -17,7 +17,7 @@ jobs: fail-fast: false matrix: os: [ubuntu-latest, macos-latest, windows-latest] - ruby: ['2.1', '2.2', '2.3', '2.4', '2.5', '2.6', '2.7', '3.0', '3.1', '3.2', '3.3', '3.4'] + ruby: ['2.1', '2.2', '2.3', '2.4', '2.5', '2.6', '2.7', '3.0', '3.1', '3.2', '3.3', '3.4', '4.0'] exclude: # CRuby < 2.6 does not support macos-arm64. - { os: macos-latest, ruby: '2.1' } diff --git a/Gemfile b/Gemfile index 65690b5..73ac4f5 100644 --- a/Gemfile +++ b/Gemfile @@ -27,6 +27,11 @@ end group :test do gem 'mocha' + # No longer default gems in Ruby 4.0. + if RUBY_VERSION >= '4.0' + gem 'logger' + gem 'irb' + end if RUBY_VERSION < '3.0' gem 'fakefs', '~> 0.13.3' else From 601f35bac8666c16e58d43ea88536fb0f5f9f3c5 Mon Sep 17 00:00:00 2001 From: Loic Nageleisen Date: Fri, 30 Oct 2026 17:18:19 +0100 Subject: [PATCH 6/6] Add Fiddle for Ruby 4.0 test dependencies Reline requires `fiddle/import` for its Windows backend when FakeFS loads IRB. Declare `fiddle` alongside the other former default gems so the Ruby 4.0 Windows suite can load. --- Gemfile | 1 + 1 file changed, 1 insertion(+) diff --git a/Gemfile b/Gemfile index 73ac4f5..b02c3c0 100644 --- a/Gemfile +++ b/Gemfile @@ -31,6 +31,7 @@ group :test do if RUBY_VERSION >= '4.0' gem 'logger' gem 'irb' + gem 'fiddle' end if RUBY_VERSION < '3.0' gem 'fakefs', '~> 0.13.3'