From 70ff2266b32f0b266afb67eb98d70f62e6f5ed2f Mon Sep 17 00:00:00 2001 From: Jack Rothrock Date: Fri, 16 Oct 2026 11:38:03 -0600 Subject: [PATCH] Add release workflow for RubyGems trusted publishing Mirrors scout_apm_ruby's release workflow: on pushing a v* tag, publishes the gem to RubyGems.org via trusted publishing (OIDC), no stored API key. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/release.yml | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) create mode 100644 .github/workflows/release.yml diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml new file mode 100644 index 0000000..52748a3 --- /dev/null +++ b/.github/workflows/release.yml @@ -0,0 +1,30 @@ +name: Release Gem + +on: + push: + tags: + - 'v*' + +# Directly from https://github.com/rubygems/release-gem/tree/v1 +# Predicated on Tag Ruleset preventing arbitrary tag creation and +# requiring checks to pass for commit before tag creation +jobs: + push: + name: Push gem to RubyGems.org + runs-on: ubuntu-latest + + permissions: + id-token: write # IMPORTANT: this permission is mandatory for trusted publishing + contents: write # IMPORTANT: this permission is required for `rake release` to push the release tag + + steps: + # Set up + - uses: actions/checkout@v4 + - name: Set up Ruby + uses: ruby/setup-ruby@v1 + with: + bundler-cache: true + ruby-version: ruby + + # Release + - uses: rubygems/release-gem@v1