ci: publish to RubyGems via trusted publishing

.github/workflows/release.yml

@@ -9,8 +9,10 @@ on:
 jobs:
   publish:
     runs-on: ubuntu-latest
+    environment: release
     permissions:
       contents: write
+      id-token: write
     steps:
       - uses: actions/checkout@v4
       - uses: ruby/setup-ruby@v1
@@ -19,10 +21,10 @@ jobs:
           bundler-cache: true
       - name: Build gem
         run: gem build activemail.gemspec
+      # Credentials expire 15 minutes after this step, so build first.
+      - uses: rubygems/configure-rubygems-credentials@6861877652452567c1a007a50badad3d316fc9ba
       - name: Push to RubyGems
         run: gem push activemail-*.gem
-        env:
-          GEM_HOST_API_KEY: ${{ secrets.RUBYGEMS_API_KEY }}
       - name: Publish GitHub release
         if: startsWith(github.ref, 'refs/tags/v')
         env:

CHANGELOG.md

@@ -5,6 +5,13 @@ All notable changes to this project are documented here.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.2.2] - 2026-07-23
+
+### Changed
+
+- Publish to RubyGems via trusted publishing (OIDC) instead of a long-lived API key.
+- Harden the `blank_link_rel=` setter (internal, no behaviour change).
+
 ## [1.2.1] - 2026-07-01
 
 ### Changed

lib/activemail/configuration.rb

@@ -198,7 +198,7 @@ def blank_link_rel=(value)
       raise TypeError, "blank_link_rel must be a String or nil, got #{value.inspect} (#{value.class})" unless value.nil? || value.is_a?(String)
 
       normalized = value&.strip
-      @blank_link_rel = normalized&.empty? ? nil : normalized
+      @blank_link_rel = normalized && normalized.empty? ? nil : normalized
     end
 
     sig { params(value: T.untyped).returns(ActiveMail::ComponentMap) }

lib/activemail/version.rb

@@ -2,5 +2,5 @@
 # frozen_string_literal: true
 
 module ActiveMail
-  VERSION = '1.2.1'
+  VERSION = '1.2.2'
 end