trusted publishing (#188)

Author: mensfeld

.github/workflows/push.yml

@@ -0,0 +1,36 @@
+name: Push Gem
+
+on:
+  push:
+    tags:
+      - v*
+
+permissions:
+  contents: read
+
+jobs:
+  push:
+    if: github.repository_owner == 'karafka'
+    runs-on: ubuntu-latest
+    environment: deployment
+
+    permissions:
+      contents: write
+      id-token: write
+
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          fetch-depth: 0
+
+      - name: Set up Ruby
+        uses: ruby/setup-ruby@1a0ff446f5856bdfec298b61a09727c860d9d480 # v1.240.0
+        with:
+          bundler-cache: false
+
+      - name: Bundle install
+        run: |
+          bundle install --jobs 4 --retry 3
+
+      # Release
+      - uses: rubygems/release-gem@9e85cb11501bebc2ae661c1500176316d3987059 # v1

CHANGELOG.md

@@ -1,5 +1,8 @@
 # Karafka Core Changelog
 
+## 2.5.1 (2025-05-23)
+- [Change] Move to trusted-publishers and remove signing since no longer needed.
+
 ## 2.5.0 (2025-05-21)
 - [Change] Set minimum `karafka-rdkafka` on `0.19.2` to support new features.
 

Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    karafka-core (2.5.0)
+    karafka-core (2.5.1)
       karafka-rdkafka (>= 0.19.2, < 0.21.0)
       logger (>= 1.6.0)
 

Rakefile

@@ -0,0 +1,4 @@
+# frozen_string_literal: true
+
+require 'bundler/setup'
+require 'bundler/gem_tasks'

certs/cert.pem

@@ -21,11 +21,6 @@ Gem::Specification.new do |spec|
 
   spec.required_ruby_version = '>= 3.1.0'
 
-  if $PROGRAM_NAME.end_with?('gem')
-    spec.signing_key = File.expand_path('~/.ssh/gem-private_key.pem')
-  end
-
-  spec.cert_chain    = %w[certs/cert.pem]
   spec.files         = `git ls-files -z`.split("\x0").reject { |f| f.match(%r{^(spec)/}) }
   spec.require_paths = %w[lib]
 

karafka-core.gemspec

@@ -4,6 +4,6 @@ module Karafka
   module Core
     # Current Karafka::Core version
     # We follow the versioning schema of given Karafka version
-    VERSION = '2.5.0'
+    VERSION = '2.5.1'
   end
 end