ci: publish the gem via RubyGems trusted publishing - #2
Merged
Merged
Conversation
Releasing meant building the gem locally and pushing it with a personal API key, which the account's "UI and API" MFA level turns into a manual OTP prompt on every release. Publish from GitHub Actions instead. `rubygems/release-gem` mints an OIDC token that RubyGems exchanges for a short-lived scoped credential, so no API key is stored anywhere and no OTP is needed. The workflow triggers on a published GitHub release. The tag already exists at that point, and bundler's release task skips tagging when `already_tagged?` is true, so it only builds and pushes. The suite runs first so a red build cannot reach RubyGems. Requires a trusted publisher for Halvanhelv/deepl_diff with workflow filename release.yml to be registered on RubyGems.org.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Releasing currently means building the gem locally and pushing it with a personal API key. The account's MFA level is UI and API, so every push also needs a manual OTP — which is what blocked the 1.1.0 release.
This publishes from GitHub Actions instead.
rubygems/release-gemmints an OIDC token that RubyGems exchanges for a short-lived scoped credential: no API key stored anywhere, no OTP.How it works
workflow_dispatchfor manual runs).bundle exec rspecfirst, so a red build cannot reach RubyGems.rubygems/release-gem@v1runsbundle exec rake release. At release-published time the tag already exists, and bundler'srelease:source_control_pushtask is a no-op whenalready_tagged?is true — so it only builds and pushes the gem.id-token: writemints the OIDC token;contents: writecovers the tag push on theworkflow_dispatchpath where the tag does not exist yet.Setup required before this works
On RubyGems.org → Settings → Pending Trusted Publishers → Add, register:
Halvanhelvdeepl_diffrelease.ymlTest plan
Once the trusted publisher is registered, re-run the workflow against the existing
v1.1.0release (Actions → Release → Run workflow, or re-publish the release). It should buildpkg/deepl_diff-1.1.0.gemand push it without any credential prompt.https://claude.ai/code/session_01Pda49PcgziFVnibkKKjXRE