new or updated GitHub action for push (aka one-line trusted publishing) about rubygems.org HOT 4 CLOSED

This ticket does not include any provenance/SLSA, or sigstore/signing. This ticket is purely about getting the invocation streamlined. We still need to create tickets (separate from this one, and that will not be blocked by this one) that describe how provenance/SLSA and sigstore/signing are going to work on both the GitHub actions and RubyGems.org sides.

from rubygems.org.

I am ok with simply having that single option, and offering anyone who wants to customize that they can copy and paste the contents from rubygems/release (eg the top code block in this ticket) and customize from there.

If you think it would be better to have composable/replaceable pieces for the flow, I could imagine a hypothetical steps for the rubygems/publish action that could look something like this:

    steps:
      # Set up
      - uses: actions/checkout@v4
      - name: Set up Ruby
        uses: ruby/setup-ruby@v1
        with:
          bundler-cache: true
          ruby-version: ruby
      # Release
      - uses: rubygems/[email protected]
      - uses: rubygems/release@v1
      - name: Wait for release to propagate
        run: gem exec rubygems-await -- pkg/*.gem

And then hypothetical steps for rubygems/release could look something like this:

    steps:
      - name: Set remote URL
        run: |
          # Attribute commits to the last committer on HEAD
          git config --global user.email "$(git log -1 --pretty=format:'%ae')"
          git config --global user.name "$(git log -1 --pretty=format:'%an')"
          git remote set-url origin "https://x-access-token:${{ secrets.GITHUB_TOKEN }}@github.com/$GITHUB_REPOSITORY"
      - name: Release
        run: bundle exec rake release

Given that we haven't yet built the separated SLSA-compliant workflows that will have to be separate, I am also happy to wait on dividing the separate and composable pieces until we build that and know where those should be.

In the meantime, I think we need to ship trusted publishing with a default, happy-path, CI-based option that is on par with the simplicity of the CLI's bundle exec rake release command, to encourage developers to use that instead of continuing to run the releases from their laptop because it feels less complicated.

from rubygems.org.

Notes from discussion:

• action name most likely rubygems/release-gem
• no SLSA or sigstore components
• only covers the happy path, if you need customization please feel free to copy out the contents into your own workflow and adjust as needed
• goal is to be as easy as bundle exec rake release but for CI-based trusted publishing

from rubygems.org.

https://github.com/rubygems/release-gem

from rubygems.org.