Migrate gem publishing to RubyGems Trusted Publishing (OIDC) - #4151
Conversation
|
- Remove Create .gem credentials step and RUBYGEMS_TOKEN_SHARED secret - Replace `bundle exec rake release` with rubygems/release-gem@v1 - Add job-level permissions: id-token: write and contents: write - Add persist-credentials: false to checkout step - Add environment: release to publish-main job - Remove duplicate actions/setup-node@v5 step
| npm ci | ||
| - name: Publish Gem | ||
| run: bundle exec rake release | ||
| uses: rubygems/release-gem@v1 |
There was a problem hiding this comment.
@copilot Are you sure that this action runs my rake release task?
There was a problem hiding this comment.
No — rubygems/release-gem@v1 does not run rake release. It calls gem build followed by gem push (using the OIDC token) directly, bypassing Bundler's rake task entirely.
In this workflow that's fine: publish-main only triggers on the release event, meaning the GitHub release and its git tag already exist before this job runs. The only thing left to do is build the .gem file and push it to RubyGems.org, which is exactly what the action handles. The git-tagging portion of rake release is not needed here.
| publish-main: | ||
| if: ${{ github.event_name == 'release' }} | ||
| runs-on: ubuntu-latest | ||
| environment: release |
There was a problem hiding this comment.
We're not using environments here
| environment: release |
There was a problem hiding this comment.
Removed in 0b8b1b0.
jonrohan
added
the
skip changeset
Per reviewer feedback, environments are not in use here.
There was a problem hiding this comment.
Pull request overview
This PR migrates the gem publishing portion of the release workflow from a long-lived RubyGems API token (RUBYGEMS_TOKEN_SHARED) to RubyGems Trusted Publishing via GitHub OIDC, using the official rubygems/release-gem@v1 action.
Changes:
- Replaces the
bundle exec rake release+.gem/credentialstoken flow withrubygems/release-gem@v1(OIDC). - Adds job-level OIDC permissions and disables checkout credential persistence.
- Removes the duplicate Node setup step and keeps
actions/setup-node@v6with npm caching.
Show a summary per file
| File | Description |
|---|---|
| .github/workflows/release.yml | Switches gem publishing to OIDC Trusted Publishing and removes dependency on a long-lived RubyGems token secret. |
Review details
- Files reviewed: 1/1 changed files
- Comments generated: 2
- Review effort level: Low
| runs-on: ubuntu-latest | ||
| permissions: | ||
| id-token: write | ||
| contents: write | ||
| steps: |
| permissions: | ||
| id-token: write | ||
| contents: write |
Removes the static
RUBYGEMS_TOKEN_SHAREDsecret from the release workflow and replaces it with RubyGems Trusted Publishing via OIDC, following the official RubyGems guide.Changes to
publish-mainjobenvironment: release— required for the trusted publisher configuration on RubyGems.orgid-token: write(OIDC token exchange) andcontents: write(git tag operations); scoped to job level for least privilegepersist-credentials: falseon checkout — recommended byrubygems/release-gemCreate .gem credentialsstep — no longer needed; eliminatesRUBYGEMS_TOKEN_SHAREDsecret dependencybundle exec rake releasewithrubygems/release-gem@v1— handles gem build and push via OIDCactions/setup-node@v5step — workflow had both v5 and v6 node setup calls; kept v6NPM publishing and all other release jobs (
release-main,release-canary,release-candidate) are unchanged.What are you trying to accomplish?
Eliminate the long-lived
RUBYGEMS_TOKEN_SHAREDsecret in favor of short-lived OIDC tokens issued per-run, reducing the blast radius of credential exposure.Screenshots
N/A
Integration
Requires a matching Trusted Publisher entry configured on RubyGems.org for this repository (environment:
release, workflow:release.yml). No application code changes.Risk Assessment
What approach did you choose and why?
Used
rubygems/release-gem@v1as the official action — it handles gem build, signing, and push with the OIDC token transparently. The only viable alternative (keeping the token secret) is what we're moving away from.Anything you want to highlight for special attention from reviewers?
The RubyGems.org Trusted Publisher must be configured before this workflow runs or the release will fail. Confirm the publisher entry exists with
environment: releaseandworkflow: release.ymlon the gem's trusted publishers page.Merge checklist