ci: add fast RubyGems key verification workflow
Validates the RUBYGEMS_API_KEY secret authenticates with RubyGems without building or publishing a gem. The release workflow builds native gems before pushing, so it is a slow and tag-coupled way to discover a bad/missing key. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
keypair34 committed
Jun 17, 2026 at 16:16 UTC
72c46e3506136d79705f337d51281d33f7fd5d78
1 file changed
+40
.github/workflows/verify-rubygems-key.yml
new
+40
@@ -0,0 +1,40 @@
1
+name: Verify RubyGems Key
2
+
3
+# Fast, no-publish check that the RUBYGEMS_API_KEY secret is present and
4
+# authenticates with RubyGems.org. Use this to validate the secret before
5
+# cutting a gem release (the release workflow builds native gems first, so it
6
+# is a slow way to discover a bad key).
7
+
8
+on:
9
+ workflow_dispatch:
10
+
11
+permissions:
12
+ contents: read
13
+
14
+jobs:
15
+ verify:
16
+ name: Verify RUBYGEMS_API_KEY
17
+ runs-on: ubuntu-latest
18
+ steps:
19
+ - name: Check the key authenticates with RubyGems
20
+ env:
21
+ RUBYGEMS_API_KEY: ${{ secrets.RUBYGEMS_API_KEY }}
22
+ shell: bash
23
+ run: |
24
+ if [ -z "${RUBYGEMS_API_KEY}" ]; then
25
+ echo "::error::RUBYGEMS_API_KEY secret is empty or unset."
26
+ exit 1
27
+ fi
28
+
29
+ code="$(curl -s -o /tmp/me.json -w '%{http_code}' \
30
+ -H "Authorization: ${RUBYGEMS_API_KEY}" \
31
+ https://rubygems.org/api/v1/profile/me.json)"
32
+ echo "RubyGems profile API returned HTTP ${code}"
33
+
34
+ if [ "${code}" != "200" ]; then
35
+ echo "::error::Key did NOT authenticate (HTTP ${code}). Check the RUBYGEMS_API_KEY secret value and that it has push scope."
36
+ exit 1
37
+ fi
38
+
39
+ handle="$(python3 -c 'import json; print(json.load(open("/tmp/me.json")).get("handle",""))' 2>/dev/null || true)"
40
+ echo "✅ Key authenticates as: ${handle:-<unknown account>}"