Add automated gem release via RubyGems trusted publishing - #21
Merged
Merged
Conversation
benrfairless
marked this pull request as ready for review
August 12, 2026 01:56
![sentry[bot]](https://avatars.githubusercontent.com/in/12637?s=60&v=4){kind=small}
benrfairless
force-pushed
the
chore/add-release-automation
branch
from
August 12, 2026 03:00
f47a829 to
ddfda72
Compare
ianheggie-oaf
approved these changes
Aug 12, 2026
ianheggie-oaf
left a comment
ianheggie-oaf
left a comment
Member
There was a problem hiding this comment.
Approved - LGTM at a glance
benrfairless
force-pushed
the
chore/add-release-automation
branch
from
August 12, 2026 03:51
ddfda72 to
a0a6137
Compare
benrfairless
force-pushed
the
chore/add-release-automation
branch
from
August 13, 2026 06:03
a0a6137 to
cf19945
Compare
benrfairless
force-pushed
the
chore/add-release-automation
branch
from
August 14, 2026 05:37
cf19945 to
9b93041
Compare
Adds a release workflow that publishes morph-cli to rubygems.org whenever a version bump lands on main, using RubyGems trusted publishing (OIDC) via rubygems/release-gem — no long-lived API keys. - Triggers on pushes to main that touch lib/morph-cli/version.rb (plus manual workflow_dispatch) - A check job compares MorphCLI::VERSION against the versions already on rubygems.org and skips publishing when the version is already released, guarding against republishing - The release job runs in the 'rubygems' environment with id-token and contents write permissions; rubygems/release-gem runs 'rake release', which builds the gem, pushes the vX.Y.Z tag and publishes via trusted publishing - Document exact version-bump steps in a new 'Releasing a new version' README section, along with the one-time trusted publisher setup a gem owner must perform on rubygems.org (repository openaustralia/morph-cli, workflow release.yml, environment rubygems) and the matching GitHub environment The already-published guard was verified against the live rubygems.org API for both the published (0.2.5) and unpublished (0.3.0) cases. Assisted-by: opencode/anthropic.claude-fable-5 Signed-off-by: Ben Fairless <ben@oaf.org.au>
Addresses review feedback: curl -f exits non-zero on the 404 the rubygems.org versions API returns for a gem with no published versions, which would have failed the check job and blocked a first release. Treat that case as 'no versions published' and fall through to releasing. rubygems.org rejecting duplicate pushes remains the backstop if the check ever fails open. Assisted-by: opencode/anthropic.claude-fable-5 Signed-off-by: Ben Fairless <ben@oaf.org.au>
Match the Ruby 3.2.2 baseline pinned for Morph.io compatibility. Assisted-by: Claude Code:anthropic.claude-fable-5
benrfairless
force-pushed
the
chore/add-release-automation
branch
from
August 14, 2026 05:39
9b93041 to
f05e696
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Adds automated publishing to rubygems.org using RubyGems trusted publishing (OIDC — no long-lived API keys):
.github/workflows/release.yml, triggered by pushes tomainthat touchlib/morph-cli/version.rb(plusworkflow_dispatch)checkjob readsMorphCLI::VERSIONand queries the rubygems.org versions API; publishing is skipped when that version is already released, guarding against republishingreleasejob runs in arubygemsenvironment withid-token: write+contents: writeand usesrubygems/release-gem@v1, which runsrake release: builds the gem, creates and pushes thevX.Y.Ztag, and publishes via trusted publishingopenaustralia, repositorymorph-cli, workflow filenamerelease.yml, environmentrubygems) plus creating the matching GitHub environmentNet effect: a version bump merged to
mainresults in a published gem; merges that don't change the version are a no-op.Motivation and Context
Releases are currently manual (
rake releasefrom a maintainer's machine with an API key). Trusted publishing removes key management, and the workflow makes releasing a normal reviewed PR. Part 5 (final) of the modernisation series.How Has This Been Tested?
The republish guard was verified against the live rubygems.org API for both the already-published (0.2.5 → skip) and unpublished (0.3.0 → release) cases. Workflow YAML validated;
bundle exec rspecandbundle exec rubocopremain green. The publish job itself can only be exercised after a gem owner completes the one-time trusted publisher setup described in the README — it will no-op safely (check job) until a version bump lands.Screenshots (if appropriate):
N/A
Types of Changes
Checklist:
Action required after merge
A gem owner must configure the trusted publisher on rubygems.org and create the
rubygemsGitHub environment — steps are in the README section added by this PR. Until then the workflow cannot publish.Part 5 of the 5-PR modernisation series. Stacked on #20 (base branch
chore/update-gem-metadata); GitHub will retarget as the stack merges. Merge order: #17 → #18 → #19 → #20 → this.Assisted-by: opencode/anthropic.claude-fable-5