activeadmin_mcp is published to RubyGems.org via
Trusted Publishing (OIDC). No API key is stored in the repo or in GitHub
secrets — RubyGems verifies the Release GitHub Actions workflow directly.
Releases are driven by GitHub Releases. Publishing a release with a
vX.Y.Z tag triggers .github/workflows/release.yml, which:
- Derives the version from the release tag.
- Writes it into
lib/activeadmin_mcp/version.rb. - Runs the specs, then builds and publishes the gem to RubyGems via OIDC.
- Commits the version bump back to the default branch.
The release tag is the single source of truth for the version — you do not edit
version.rb by hand.
Because the gem does not exist on RubyGems yet, register a pending trusted publisher first — this both reserves the name and authorises the workflow:
- Sign in at https://rubygems.org (the account must have MFA enabled — the
gemspec sets
rubygems_mfa_required). - Go to https://rubygems.org/profile/oidc/pending_trusted_publishers/new.
- Fill in:
- RubyGems gem name:
activeadmin_mcp - GitHub repository:
OLIOEX/activeadmin_mcp - Workflow filename:
release.yml - Environment (optional but recommended):
rubygems
- RubyGems gem name:
- Save.
Then, in the GitHub repo settings, create an Environment named rubygems
(Settings → Environments → New environment) to match the workflow's
environment: rubygems. Add required reviewers there if you want a manual gate
before each publish.
Once the gem has been published the first time, the pending publisher becomes a regular trusted publisher automatically — no further RubyGems setup is needed.
- Move the relevant
CHANGELOG.mdentries under a new version heading with the release date (open a PR and merge tomainif you want this on the tagged commit). - On GitHub, go to Releases → Draft a new release.
- Create a new tag
vX.Y.Z(targetingmain), give the release a title and notes, and click Publish release.
Publishing the release triggers .github/workflows/release.yml, which bumps
version.rb to match the tag, runs the specs, publishes the gem to RubyGems via
OIDC, and commits the version bump back to main.
Branch protection: the workflow pushes the version-bump commit to the default branch using the built-in
GITHUB_TOKEN. Ifmainrequires pull requests or status checks for every push, either allow thegithub-actions[bot]actor to bypass protection or remove the commit-back step and bumpversion.rbmanually before releasing.
To verify the packaged gem without publishing:
bundle exec rake build # writes pkg/activeadmin_mcp-<version>.gemDo not run rake release locally — publishing happens only through the
tagged CI workflow.