Release using RubyGems Trusted Publishing

Author: FooBarWidget

.github/workflows/ci.yaml

@@ -24,7 +24,9 @@ jobs:
     steps:
       - name: Checkout code
         if: github.event_name == 'push'
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
+        with:
+          persist-credentials: false
 
       - name: Checkout PR code
         if: github.event_name == 'pull_request_target'
@@ -50,7 +52,9 @@ jobs:
     steps:
       - name: Checkout code
         if: github.event_name == 'push'
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
+        with:
+          persist-credentials: false
 
       - name: Checkout PR code
         if: github.event_name == 'pull_request_target'
@@ -69,4 +73,4 @@ jobs:
         run: bundle exec standardrb
 
       - name: Build gem
-        run: gem build daemon_controller.gemspec
+        run: bundle exec rake gem

.github/workflows/release.yaml

@@ -16,7 +16,9 @@ jobs:
       attestations: write
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
+        with:
+          persist-credentials: false
 
       - name: Set up Ruby
         uses: ruby/setup-ruby@v1
@@ -37,20 +39,14 @@ jobs:
             exit 1
           fi
 
-      - name: Build gem
-        run: gem build daemon_controller.gemspec
+      - uses: rubygems/release-gem@v1
 
       - name: Create attestation
         uses: actions/attest-build-provenance@v2
         with:
-          subject-path: "daemon_controller-*.gem"
-
-      - name: Push gem to RubyGems
-        run: gem push daemon_controller-*.gem
-        env:
-          GEM_HOST_API_KEY: ${{ secrets.RUBYGEMS_API_KEY }}
+          subject-path: "pkg/daemon_controller-*.gem"
 
       - name: Create GitHub release
-        run: gh release create "$GITHUB_REF_NAME" *.gem --title "$GITHUB_REF_NAME" --notes-from-tag
+        run: gh release create "$GITHUB_REF_NAME" pkg/*.gem --title "$GITHUB_REF_NAME" --notes-from-tag
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.gitignore

@@ -1,6 +1,7 @@
 .DS_Store
 .vscode
 *.gem
+/pkg
 spec/echo_server.log
 spec/echo_server.pid
 spec/echo_server.pid.lock

Rakefile

@@ -8,15 +8,13 @@ task :test do
   ruby "-S rspec spec/*_spec.rb"
 end
 
-desc "Build & upload gem"
-task "package:release" do
-  sh "git tag -s release-#{PACKAGE_VERSION}"
-  sh "gem build #{PACKAGE_NAME}.gemspec"
-  puts "Proceed with pushing tag to Github and uploading the gem? [y/n]"
-  if $stdin.readline == "y\n"
-    sh "git push origin release-#{PACKAGE_VERSION}"
-    sh "gem push #{PACKAGE_NAME}-#{PACKAGE_VERSION}.gem"
-  else
-    puts "Did not upload the gem."
-  end
+desc "Build gem"
+task :gem do
+  mkdir_p "pkg"
+  sh "gem build daemon_controller.gemspec -o pkg/#{PACKAGE_NAME}-#{PACKAGE_VERSION}.gem"
+end
+
+desc "Build release artifacts"
+task release: :gem do
+  sh "gem push pkg/#{PACKAGE_NAME}-#{PACKAGE_VERSION}.gem"
 end