Push gems with RubyGems trusted publishing
Replace the RUBYGEMS_API_KEY secret with an OIDC exchange through rubygems/configure-rubygems-credentials. The push job gets id-token: write and the key is short lived. This also removes the problem of a scoped key refusing the first push of a new gem: smbcloud-email can use a pending trusted publisher instead. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Seto Elkahfi committed
Oct 24, 2026 at 13:15 UTC
f749b0d14c284a9fa67409fa815ead691ddbea03
1 file changed
+12
-10
.github/workflows/release-sdk-gem.yml
+12
-10
@@ -10,11 +10,12 @@ name: SDK Ruby Gem Release
10
#
11
# Pull requests that touch the gems build everything but publish nothing.
12
#
13
-# Required secrets:
14
-# RUBYGEMS_API_KEY — RubyGems.org API key that can push smbcloud-auth,
15
-# smbcloud-model and smbcloud-email. It must be able to
16
-# push a NEW gem (not scoped to existing gems only), or
17
-# the first smbcloud-email push is refused.
13
+# Gems are pushed with RubyGems trusted publishing (OIDC), so there is no API
14
+# key secret. Each gem needs a trusted publisher on rubygems.org for repository
15
+# smbcloudXYZ/smbcloud-cli, workflow release-sdk-gem.yml, with no environment.
16
+# A gem that does not exist yet (smbcloud-email) needs a *pending* trusted
17
+# publisher, created from the owner's profile; the first push turns it into a
18
+# normal one. See https://guides.rubygems.org/trusted-publishing/
19
20
on:
21
workflow_dispatch:
@@ -201,6 +202,9 @@ jobs:
202
needs: [build-gems, build-source-gem]
203
if: github.event_name == 'workflow_dispatch'
204
runs-on: ubuntu-latest
205
+ permissions:
206
+ contents: read
207
+ id-token: write
208
strategy:
209
fail-fast: false
210
matrix:
@@ -237,12 +241,10 @@ jobs:
241
with:
242
ruby-version: .ruby-version
243
244
+ # Exchanges this job's OIDC token for a short-lived RubyGems API key and
245
+ # exports it as GEM_HOST_API_KEY, which `gem push` reads.
246
- name: Configure RubyGems credentials
241
- shell: bash
242
- run: |
243
- mkdir -p "${HOME}/.gem"
244
- echo ":rubygems_api_key: ${{ secrets.RUBYGEMS_API_KEY }}" > "${HOME}/.gem/credentials"
245
- chmod 0600 "${HOME}/.gem/credentials"
247
+ uses: rubygems/configure-rubygems-credentials@v2.1.0
248
249
# Push each .gem file individually. A file that is already published (a
250
# re-run, or completing a partial release) is skipped; any other failure