Release using RubyGems Trusted Publishing

Author: FooBarWidget

.github/workflows/ci.yaml

@@ -24,7 +24,9 @@ jobs:
     steps:
       - name: Checkout code
         if: github.event_name == 'push'
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
+        with:
+          persist-credentials: false
 
       - name: Checkout PR code
         if: github.event_name == 'pull_request_target'
@@ -50,7 +52,9 @@ jobs:
     steps:
       - name: Checkout code
         if: github.event_name == 'push'
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
+        with:
+          persist-credentials: false
 
       - name: Checkout PR code
         if: github.event_name == 'pull_request_target'
@@ -69,4 +73,4 @@ jobs:
         run: bundle exec standardrb
 
       - name: Build gem
-        run: gem build daemon_controller.gemspec
+        run: bundle exec rake release

.github/workflows/release.yaml

@@ -16,7 +16,9 @@ jobs:
       attestations: write
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
+        with:
+          persist-credentials: false
 
       - name: Set up Ruby
         uses: ruby/setup-ruby@v1
@@ -37,19 +39,13 @@ jobs:
             exit 1
           fi
 
-      - name: Build gem
-        run: gem build daemon_controller.gemspec
+      - uses: rubygems/release-gem@v1
 
       - name: Create attestation
         uses: actions/attest-build-provenance@v2
         with:
           subject-path: "daemon_controller-*.gem"
 
-      - name: Push gem to RubyGems
-        run: gem push daemon_controller-*.gem
-        env:
-          GEM_HOST_API_KEY: ${{ secrets.RUBYGEMS_API_KEY }}
-
       - name: Create GitHub release
         run: gh release create "$GITHUB_REF_NAME" *.gem --title "$GITHUB_REF_NAME" --notes-from-tag
         env:

Rakefile

@@ -8,15 +8,7 @@ task :test do
   ruby "-S rspec spec/*_spec.rb"
 end
 
-desc "Build & upload gem"
-task "package:release" do
-  sh "git tag -s release-#{PACKAGE_VERSION}"
-  sh "gem build #{PACKAGE_NAME}.gemspec"
-  puts "Proceed with pushing tag to Github and uploading the gem? [y/n]"
-  if $stdin.readline == "y\n"
-    sh "git push origin release-#{PACKAGE_VERSION}"
-    sh "gem push #{PACKAGE_NAME}-#{PACKAGE_VERSION}.gem"
-  else
-    puts "Did not upload the gem."
-  end
+desc "Build release artifacts"
+task :release do
+  sh "gem build daemon_controller.gemspec"
 end