From bd00e753cda5f067904b961243243ab494a94665 Mon Sep 17 00:00:00 2001 From: doris-xiao-bybit Date: Wed, 22 Jul 2026 18:40:18 +0800 Subject: [PATCH] fix(ci): use rubygems/release-gem@v1 for OIDC trusted publishing MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The previous publish step invoked `gem exec rubygems-trusted-publishing`, which references a gem that doesn't exist on rubygems.org — failing every release with: Could not find a valid gem 'rubygems-trusted-publishing' (>= 0) The rubygems/release-gem@v1 action is the officially-supported way to do OIDC-based trusted publishing: it requests a token from GitHub's OIDC provider (using `id-token: write`), exchanges it for a short-lived rubygems.org API key, and runs `gem build` + `gem push` with that key. Requirements on the rubygems.org side (already configured for bybit-exchange/bybit.ruby.api): - Trusted publisher for the correct repo + workflow filename - Environment field on rubygems must match the workflow's environment (or both must be empty — our workflow has no environment) Also drops the RUBYGEMS_API_KEY fallback: trusted publishing is the only supported path going forward, and mixing OIDC with an API-key secret would introduce a confusing race. Co-Authored-By: Claude Opus 4.7 (1M context) --- .github/workflows/publish.yml | 41 ++++++++++------------------------- 1 file changed, 12 insertions(+), 29 deletions(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 6dee3f1..3af3d93 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -8,9 +8,11 @@ on: jobs: publish: runs-on: ubuntu-latest - # id-token: write enables rubygems.org OIDC trusted publishing if the gem - # is configured for it (Aug-2024 feature). Falls back to RUBYGEMS_API_KEY - # when a trusted-publisher config isn't set up — see the "Publish" step. + # id-token: write is required for rubygems.org OIDC Trusted Publishing. + # The rubygems/release-gem action exchanges GitHub's OIDC token for a + # short-lived rubygems.org API key — no long-lived RUBYGEMS_API_KEY + # secret is needed. Trusted publisher config on rubygems.org must match + # (repo, workflow filename, environment). permissions: contents: read id-token: write @@ -49,29 +51,10 @@ jobs: bundle exec rubocop --parallel bundle exec rspec - - name: Build .gem - run: gem build bybit-connector-ruby.gemspec - - # Trusted publishing (OIDC) — no long-lived token required. If the gem - # is NOT yet configured for trusted publishing on rubygems.org, set - # RUBYGEMS_API_KEY as a repo secret and this step will fall back to it. - - name: Publish to rubygems - env: - RUBYGEMS_API_KEY: ${{ secrets.RUBYGEMS_API_KEY }} - run: | - set -eu - GEM=$(ls bybit-connector-ruby-*.gem | head -1) - if command -v rubygems-await >/dev/null 2>&1; then :; fi - if [ -n "${RUBYGEMS_API_KEY:-}" ]; then - echo "Using RUBYGEMS_API_KEY auth" - mkdir -p ~/.gem - echo -e ":rubygems_api_key: ${RUBYGEMS_API_KEY}" > ~/.gem/credentials - chmod 600 ~/.gem/credentials - gem push "$GEM" - else - echo "No RUBYGEMS_API_KEY; assuming OIDC trusted publisher is configured on rubygems.org" - gem exec rubygems-trusted-publishing --push "$GEM" || { - echo "::error::Neither RUBYGEMS_API_KEY nor a trusted-publisher config found. Set one of them." - exit 1 - } - fi + # Trusted publishing via OIDC. rubygems/release-gem@v1: + # 1. Requests an OIDC token from GitHub's provider (needs id-token: write above). + # 2. Exchanges it with rubygems.org for a short-lived API key. + # 3. Runs gem build + gem push using that key. + # No long-lived RUBYGEMS_API_KEY secret required. + - name: Release gem (OIDC trusted publishing) + uses: rubygems/release-gem@v1