CD: switch gem-push to RubyGems Trusted Publishing (OIDC)#40
Merged
Conversation
`gem push` fails since MFA was enabled on the RubyGems account — the API-key flow can't supply an OTP from a non-interactive runner. Trusted publishing is the supported replacement and is already configured on rubygems.org for this gem (pointed at this workflow file, no GitHub Environment binding). Changes: - Add `id-token: write` to job permissions (required for the GitHub OIDC token exchange). - Remove unused `packages: write` permission (was for GitHub Packages, never wired up). - Replace the manual credentials-file dance + `GEM_HOST_API_KEY` env var with `rubygems/configure-rubygems-credentials@v2.0.0` (same action `rubygems/release-gem@v1` calls internally — verified by reading its action.yml). Existing `gem build` + `gem push` then read credentials the action sets up. No new secrets. `RUBYGEMS_AUTH_TOKEN` becomes obsolete and should be deleted from repo Settings → Secrets after the first green dispatch. Tracks LOC-6563. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The previous Ruby gem publish run failed at the
gem pushstep because MFA was enabled on the RubyGems account — theRUBYGEMS_AUTH_TOKENAPI-key flow can't supply an OTP from a non-interactive runner:Trusted publishing on rubygems.org is already configured for this gem (pointed at
gem-push.yml, no GitHub Environment binding). This PR flips the workflow's authentication from API-key to OIDC so the publish completes without needing an OTP.Change
Single file:
.github/workflows/gem-push.yml.id-token: writeto job permissions (required for OIDC token generation)packages: write(was for GitHub Packages, never wired up)GEM_HOST_API_KEYenv var withrubygems/configure-rubygems-credentials@v2.0.0(the same actionrubygems/release-gem@v1calls internally — verified by reading itsaction.yml)gem build && gem pushthen reads credentials from where the action sets them upNet diff: 4 insertions, 8 deletions.
Why not
rubygems/release-gem@v1The high-level action runs
bundle exec rake releasewhich auto-tags + auto-commits and is designed for tag-event triggers. Our workflow isworkflow_dispatchwith manual version management — usingconfigure-rubygems-credentialsdirectly keeps the trigger + manual flow intact.Test plan
gem-push.ymlvia Actions UI orgh workflow run gem-push.yml --ref master --repo browserstack/browserstack-local-rubyConfigure RubyGems Credentialsstep succeeds (proves OIDC handshake → trusted publisher binding matched workflow filename + repo)gem pushshowsPushing gem to https://rubygems.org...followed by success, no MFA promptgem info -r browserstack-localconfirms 1.5.0 is liveCleanup (separate follow-up commit after one green dispatch)
RUBYGEMS_AUTH_TOKENfrom repo Secrets — now obsoleteReference
rubygems/release-gem@v1action.yml — confirmed the official action delegates torubygems/configure-rubygems-credentials@v2.0.0for the OIDC exchange🤖 Generated with Claude Code