Add RubyGems trusted publishing

.github/chainguard/self.publish.sts.yaml

@@ -0,0 +1,13 @@
+issuer: https://token.actions.githubusercontent.com
+
+subject: repo:DataDog/dogstatsd-ruby:environment:rubygems.org
+
+claim_pattern:
+  event_name: workflow_dispatch
+  environment: rubygems.org
+  ref: refs/heads/master
+  repository: DataDog/dogstatsd-ruby
+  job_workflow_ref: DataDog/dogstatsd-ruby/\.github/workflows/publish\.yml@refs/heads/master
+
+permissions:
+  contents: write

.github/workflows/publish.yml

@@ -0,0 +1,36 @@
+name: Publish
+
+on: workflow_dispatch
+
+permissions: {}
+
+concurrency: publish
+
+jobs:
+  publish:
+    name: Build and push gem to RubyGems.org
+    if: github.repository == 'DataDog/dogstatsd-ruby' && github.ref == 'refs/heads/master'
+    runs-on: ubuntu-24.04
+    environment: rubygems.org
+    permissions:
+      contents: read
+      id-token: write # RubyGems trusted publishing and Octo STS
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+      - name: Set up Ruby
+        uses: ruby/setup-ruby@afeafc3d1ab54a631816aba4c914a0081c12ff2f # v1.310.0
+        with:
+          ruby-version: '3.4'
+          bundler-cache: true
+      - name: Run tests
+        run: bundle exec rake spec
+      - uses: DataDog/dd-octo-sts-action@96a25462dbcb10ebf0bfd6e2ccc917d2ab235b9a # v1.0.4
+        id: octo-sts
+        with:
+          scope: DataDog/dogstatsd-ruby
+          policy: self.publish
+      - uses: rubygems/release-gem@6317d8d1f7e28c24d28f6eff169ea854948bd9f7 # v1.2.0
+        with:
+          token: ${{ steps.octo-sts.outputs.token }}

.github/workflows/test.yml

@@ -17,7 +17,7 @@ jobs:
       fail-fast: false
       matrix:
         os: [ubuntu-latest, macos-latest, windows-latest]
-        ruby: [2.1, 2.2, 2.3, 2.4, 2.5, 2.6, 2.7, 3.0, 3.1, 3.2, 3.3, 3.4]
+        ruby: ['2.1', '2.2', '2.3', '2.4', '2.5', '2.6', '2.7', '3.0', '3.1', '3.2', '3.3', '3.4', '4.0']
         exclude:
           # CRuby < 2.6 does not support macos-arm64.
           - { os: macos-latest, ruby: '2.1' }
@@ -31,13 +31,10 @@ jobs:
         uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
 
       - name: Set up Ruby
-        uses: ruby/setup-ruby@ab177d40ee5483edb974554986f56b33477e21d0 # v1.265.0
+        uses: ruby/setup-ruby@7f797815d8adceb1c412e7abefdd1ab4abc47a5f # v1.335.0
         with:
           ruby-version: ${{ matrix.ruby }}
           bundler-cache: true
 
-      - name: Install dependencies
-        run: bundle install --with development
-
       - name: Run tests
         run: bundle exec rake spec

Gemfile

@@ -27,6 +27,12 @@ end
 
 group :test do
   gem 'mocha'
+  # No longer default gems in Ruby 4.0.
+  if RUBY_VERSION >= '4.0'
+    gem 'logger'
+    gem 'irb'
+    gem 'fiddle'
+  end
   if RUBY_VERSION < '3.0'
     gem 'fakefs', '~> 0.13.3'
   else

RELEASING.md

@@ -0,0 +1,19 @@
+# Releasing dogstatsd-ruby
+
+Releases use the manually triggered [Publish workflow](https://github.com/DataDog/dogstatsd-ruby/actions/workflows/publish.yml)
+on `master`.
+
+## Release procedure
+
+1. Update `lib/datadog/statsd/version.rb` and `CHANGELOG.md`, and merge the
+   release changes into `master`.
+2. Confirm that the Ruby Test workflow passes for the release commit.
+3. Run the Publish workflow, selecting `master`, and approve its deployment
+   to the `rubygems.org` environment.
+4. Confirm that the workflow succeeds and the version is available on
+   [RubyGems.org](https://rubygems.org/gems/dogstatsd-ruby).
+
+The workflow runs the specs, then invokes `rubygems/release-gem` using the
+existing Bundler `release` task. It builds the gem, creates and pushes its
+`v<version>` tag, publishes it with Sigstore provenance, and waits for it to
+be available on RubyGems.org. Do not create the release tag beforehand.