bake-gem-github 0.0.5 → 0.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: eb1ff7b71712625bd0f0732c6a945b72d555d7ccf0f318314500f61b626269aa
-  data.tar.gz: 627281b137b7161bd0f57d208f73cf8fa9e559cee46a63be7545c64e6a3ab24b
+  metadata.gz: ec4e3e7088789843fbadf6a3b8a679593e5b24e328fce5301e63fe79a10dfdf7
+  data.tar.gz: 77857229f0d478caba8181e9bdd1f5d81b2198d377cf37c9826c461531eab37d
 SHA512:
-  metadata.gz: 7e9e4d0798361689b919529a75415764c3d1d575737b5368a0bee445d406e399e8eba72a6eeee735bd01581912da8cb53496a48deff91d311b275cfe995590fa
-  data.tar.gz: ad0ade7c470f26b865b4dce5f7cee96af8f6042daf0ff35a5363a7393098ea414ee03233cfc92a70d1b622a7d83c57188e01aee3f6953d34af8b1fe903f5111d
+  metadata.gz: 046244ece39b8e166674a1368781012123175f4bd2902ea4777da518f86b148f8a85bcd0c4eda889291bc7a6e00617992dd8f35c1fef8e156e883af1458abb37
+  data.tar.gz: 0cea0e0fcbd5c3b2d8c04c432698b520a1ab9883781a5969649cb8e122cafe7657385501cc501028f3fd509de0f84d096216409af32ceecd1fef497110796a97

data/bake/gem/github/setup.rb

@@ -13,3 +13,9 @@ def apply
 	require_relative "../../../lib/bake/gem/github/project"
 	Bake::Gem::GitHub::Project.new(context.root).apply
 end
+
+# Update generated files in the working tree using config/release.yaml and the installed templates.
+def update
+	require_relative "../../../lib/bake/gem/github/setup"
+	Bake::Gem::GitHub::Setup.new(context.root).update
+end

data/context/getting-started.md

@@ -1,6 +1,6 @@
 # GitHub Releases
 
-This guide sets up reviewed Ruby gem releases with `bake-gem-github`, native GitHub rules, RubyGems Trusted Publishing, and retained release artifacts.
+This guide explains how to set up reviewed Ruby gem releases with `bake-gem-github`, native GitHub rules, RubyGems Trusted Publishing, and retained release artifacts.
 
 ## Installation
 
@@ -18,7 +18,18 @@ bundle exec bake agent:context:install
 bundle exec bake gem:github:setup:plan
 ```
 
-Setup adds three pinned workflows, `config/release.yaml`, native ruleset payloads, and `.github/releasing.md`. Identical reruns do nothing; conflicting existing files stop before any file is written. For later policy changes, edit the configuration and review the generated workflow/policy changes explicitly. Setup does not replace other publishers: remove conflicting release workflows during migration.
+Setup adds three release workflows, `config/release.yaml`, native ruleset payloads, and `.github/releasing.md`. Identical reruns do nothing; conflicting existing files stop before any file is written. Setup does not replace other publishers: remove conflicting release workflows during migration.
+
+To adopt template fixes after upgrading the gem, start from a clean working tree, edit `config/release.yaml` as needed, and regenerate:
+
+``` bash
+bundle exec bake gem:github:setup:update
+git diff
+```
+
+The task updates the managed workflows, policy payloads, configuration formatting, and maintainer instructions directly in the working tree and returns the changed paths. It does not stage, commit, or change remote settings. An agent or maintainer can review the diff and selectively keep changes, restoring repository-specific customizations from Git where needed. Commit or stash existing edits first: generated files are replaced by the current templates. Repeating an update produces no further changes; intentionally retained customizations will appear in later update diffs. Apply remote rulesets after the corresponding workflows are running.
+
+Release workflows follow `bake modernize` action versions and use moving major tags where upstream provides them. These tags receive upstream updates automatically; full commit hashes select fixed revisions. The RubyGems credentials action uses its [documented `@main` reference](https://github.com/rubygems/configure-rubygems-credentials#trusted-publisher-recommended), since upstream does not provide a moving major tag. Repositories that require fixed revisions can customize these references.
 
 The default is two approvals with explicit administrator bypass, dismissed stale reviews, approval of the last push, strict up-to-date CI, and immutable default-branch history/release tags. These branch rules affect **all PRs** into the default branch. Ordinary administrator reviews count as one review. A human who dispatches a bot-authored PR is not its author under GitHub's native rules.
 
@@ -64,6 +75,8 @@ After merge/squash, the publishing workflow verifies GitHub's merged PR record a
 
 The workflow retains the gem, receipt and attestations before obtaining RubyGems publishing credentials. It verifies both attestations, checks the uploaded bytes and registry bundle, then pushes the specific version tag and creates the GitHub release. Existing tags/assets are checked and never overwritten. The old `after_gem_release` GitHub hook is not called by this pipeline, so there is one owner for release creation.
 
+The draft release description includes the exact version's notes from `releases.md` in the merged release checkout, followed by the PR URL, source commit, and gem digest. Notes are extracted using `bake-releases`; a missing or empty section leaves the metadata as the description. Retries preserve the existing release description.
+
 ``` bash
 set -e
 for file in example-1.2.3.gem release.json; do

data/context/index.yaml

@@ -6,5 +6,5 @@ metadata: {}
 files:
 - path: getting-started.md
   title: GitHub Releases
-  description: This guide sets up reviewed Ruby gem releases with `bake-gem-github`,
+  description: This guide explains how to set up reviewed Ruby gem releases with `bake-gem-github`,
     native GitHub rules, RubyGems Trusted Publishing, and retained release artifacts.

data/lib/bake/gem/github/publisher.rb

@@ -4,6 +4,7 @@
 # Copyright, 2026, by Samuel Williams.
 
 require_relative "project"
+require "bake/releases"
 require "digest"
 require "net/http"
 require "openssl"
@@ -146,10 +147,12 @@ module Bake
 					tag = "v#{receipt.fetch(:version)}"
 					release = github_release(tag)
 					unless release
+						notes = Bake::Releases.notes(tag, path: File.join(@root, "releases.md"))
+						metadata = "#{receipt.fetch(:pull_request_url)}\n\nSource: #{receipt.fetch(:commit)}\nSHA256: #{receipt.fetch(:sha256)}\n"
 						Tempfile.create("release") do |file|
 							file.write(JSON.generate(
 								tag_name: tag, draft: true, target_commitish: receipt.fetch(:commit), name: "#{receipt.fetch(:name)} #{tag}",
-								body: "#{receipt.fetch(:pull_request_url)}\n\nSource: #{receipt.fetch(:commit)}\nSHA256: #{receipt.fetch(:sha256)}\n\nSee releases.md at the release tag for release notes.\n"
+								body: [notes, metadata].compact.join("\n")
 							))
 							file.flush
 							# The release list can remain stale after a successful creation:

data/lib/bake/gem/github/setup.rb

@@ -25,25 +25,20 @@ module Bake
 					raise "Select the required CI check names." if checks.empty?
 					raise "Review count must be between 1 and 6." unless (1..6).include?(approvals)
 					config = {"schema" => 1, "repository" => repository, "branch" => branch, "checks" => (checks + ["Release validation"]).uniq, "approvals" => approvals, "signing" => signing, "ruby" => ruby, "environment" => "rubygems"}
-					templates = File.expand_path("../../../../templates", __dir__)
-					files = {"config/release.yaml" => YAML.dump(config)}
-					Dir.glob("*.erb", base: templates).each do |name|
-						files[".github/workflows/#{name.delete_suffix('.erb')}"] = ERB.new(File.read(File.join(templates, name)), trim_mode: "-").result(binding)
-					end
-					self.class.rules(config).each do |name, rule|
-						files[".github/release-rules/#{name}.json"] = JSON.pretty_generate(rule) + "\n"
-					end
-					files[".github/releasing.md"] = File.read(File.join(templates, "releasing.md"))
+					files = render(config)
 					conflicts = files.keys.select{|name| File.exist?(File.join(@root, name)) && File.read(File.join(@root, name)) != files[name]}
 					raise "Existing files differ; review them before regenerating: #{conflicts.join(', ')}" unless conflicts.empty?
-					files.each do |name, content|
-						path = File.join(@root, name)
-						FileUtils.mkdir_p(File.dirname(path))
-						File.write(path, content) unless File.exist?(path)
-					end
+					write(files)
 					files.keys
 				end
 				
+				# Update generated files in the working tree using the existing configuration; return changed paths.
+				def update
+					config = YAML.safe_load_file(File.join(@root, "config/release.yaml"))
+					raise "Unsupported release configuration." unless config.fetch("schema") == 1
+					write(render(config))
+				end
+				
 				# Native review/check rules allow PR-only administrator bypass; history rules have no bypass.
 				def self.rules(config)
 					conditions = {ref_name: {include: ["refs/heads/#{config.fetch('branch')}"], exclude: []}}
@@ -56,6 +51,34 @@ module Bake
 						"tags" => {name: "Gem release tags", target: "tag", enforcement: "active", bypass_actors: [], conditions: {ref_name: {include: ["refs/tags/v*"], exclude: []}}, rules: [{type: "deletion"}, {type: "non_fast_forward"}]}
 					}
 				end
+				
+				private
+				
+				def write(files)
+					files.filter_map do |name, content|
+						path = File.join(@root, name)
+						next if File.exist?(path) && File.read(path) == content
+						FileUtils.mkdir_p(File.dirname(path))
+						File.write(path, content)
+						name
+					end
+				end
+				
+				def render(config)
+					branch = config.fetch("branch")
+					ruby = config.fetch("ruby")
+					signing = config.fetch("signing")
+					templates = File.expand_path("../../../../templates", __dir__)
+					files = {"config/release.yaml" => YAML.dump(config)}
+					Dir.glob("*.erb", base: templates).each do |name|
+						files[".github/workflows/#{name.delete_suffix('.erb')}"] = ERB.new(File.read(File.join(templates, name)), trim_mode: "-").result(binding)
+					end
+					self.class.rules(config).each do |name, rule|
+						files[".github/release-rules/#{name}.json"] = JSON.pretty_generate(rule) + "\n"
+					end
+					files[".github/releasing.md"] = File.read(File.join(templates, "releasing.md"))
+					files
+				end
 			end
 		end
 	end

data/lib/bake/gem/github/version.rb

@@ -9,7 +9,7 @@ module Bake
 	module Gem
 		# GitHub pull request and release orchestration for bake-gem.
 		module GitHub
-			VERSION = "0.0.5"
+			VERSION = "0.1.0"
 		end
 	end
 end

data/releases.md

@@ -1,5 +1,10 @@
 # Releases
 
+## v0.1.0
+
+  - Include the version's release notes in GitHub releases using `bake-releases`.
+  - Update generated release files in the working tree with `gem:github:setup:update`.
+
 ## v0.0.5
 
   - Preserve and recover release files even when GitHub's release list is stale.

data/templates/release-prepare.yaml.erb

@@ -25,12 +25,12 @@ jobs:
     if: github.ref == 'refs/heads/<%= branch %>'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+      - uses: actions/checkout@v7
         with:
           ref: <%= branch %>
           fetch-depth: 0
           persist-credentials: false
-      - uses: ruby/setup-ruby@a0102e0972be65f351c307e2d64b9314a57c8073 # v1
+      - uses: ruby/setup-ruby@v1
         with:
           ruby-version: <%= ruby.to_json %>
           bundler-cache: true
@@ -39,6 +39,8 @@ jobs:
           GH_TOKEN: ${{ github.token }}
           BUMP: ${{ inputs.bump }}
         run: |
+          # GitHub.com's shared Actions bot ID; this identity is not for GitHub Enterprise Server.
+          # https://github.com/actions/checkout#push-a-commit-using-the-built-in-token
           git config user.name 'github-actions[bot]'
           git config user.email '41898282+github-actions[bot]@users.noreply.github.com'
           case "$BUMP" in patch|minor|major) ;; *) exit 1 ;; esac

data/templates/release-publish.yaml.erb

@@ -27,11 +27,11 @@ jobs:
       release: ${{ steps.inspect.outputs.release }}
       commit: ${{ steps.inspect.outputs.commit }}
     steps:
-      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
           persist-credentials: false
-      - uses: ruby/setup-ruby@a0102e0972be65f351c307e2d64b9314a57c8073 # v1
+      - uses: ruby/setup-ruby@v1
         with:
           ruby-version: <%= ruby.to_json %>
           bundler-cache: true
@@ -52,12 +52,15 @@ jobs:
       id-token: write
       attestations: write
     steps:
-      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+      - uses: actions/checkout@v7
         with:
+          # Inspection verified this merged commit belongs to the default branch.
+          # Checkout v7 also blocks merged fork PRs without this explicit opt-in.
+          allow-unsafe-pr-checkout: true
           ref: ${{ needs.inspect.outputs.commit }}
           fetch-depth: 0
           persist-credentials: false
-      - uses: ruby/setup-ruby@a0102e0972be65f351c307e2d64b9314a57c8073 # v1
+      - uses: ruby/setup-ruby@v1
         with:
           ruby-version: <%= ruby.to_json %>
           rubygems: '4.0.21'
@@ -78,7 +81,7 @@ jobs:
       - name: Attest gem and release receipt
         if: steps.build.outputs.restored != 'true'
         id: attest
-        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4
+        uses: actions/attest@v4
         with:
           subject-path: |
             ${{ steps.build.outputs.package }}
@@ -90,13 +93,13 @@ jobs:
         run: cp "$ATTESTATION_BUNDLE" pkg/provenance.sigstore.json
       - name: Preserve release before upload
         if: steps.build.outputs.restored != 'true'
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        uses: actions/upload-artifact@v7
         with:
           name: ${{ steps.build.outputs.artifact }}
           path: pkg/
           if-no-files-found: error
           retention-days: 90
-      - uses: rubygems/configure-rubygems-credentials@2a7221c7c44c30ebc68eda38fa25c60b918245c7
+      - uses: rubygems/configure-rubygems-credentials@main
       - name: Verify, publish, and finalize
         env:
           GH_TOKEN: ${{ github.token }}

data/templates/release-validate.yaml.erb

@@ -15,12 +15,12 @@ jobs:
     name: Release validation
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+      - uses: actions/checkout@v7
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           fetch-depth: 0
           persist-credentials: false
-      - uses: ruby/setup-ruby@a0102e0972be65f351c307e2d64b9314a57c8073 # v1
+      - uses: ruby/setup-ruby@v1
         with:
           ruby-version: <%= ruby.to_json %>
           bundler-cache: true

data/templates/releasing.md

@@ -13,3 +13,5 @@ If a publishing job fails, use **Re-run all jobs** on that same workflow run, or
 Verify both the downloaded gem and `release.json` with `gh attestation verify`, enforcing the publishing workflow's certificate identity and default branch ref. Then check the signed receipt's source commit and gem digest; follow the companion gem's setup guide for the complete commands. `--source-digest` checks the workflow revision, which can differ from the release commit. Release assets include the gem, RubyGems Sigstore bundle, GitHub provenance bundle, and signed source/digest receipt.
 
 The initial implementation supports public repositories, a single gemspec, stable patch/minor/major versions, and merge/squash commits. Keep rebase merges and merge queues disabled. Generation hooks must be repeatable from the same source and version. Run setup and account recovery checks before enabling publishing; see the companion gem's setup guide.
+
+After upgrading `bake-gem-github`, start from a clean working tree and run `bundle exec bake gem:github:setup:update`. It updates generated files without staging or committing them. Review `git diff`, selectively keep changes and restore customizations as needed, then open a PR.

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: bake-gem-github
 version: !ruby/object:Gem::Version
-  version: 0.0.5
+  version: 0.1.0
 platform: ruby
 authors:
 - Samuel Williams
@@ -48,6 +48,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: 0.15.0
+- !ruby/object:Gem::Dependency
+  name: bake-releases
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.6'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.6'
 - !ruby/object:Gem::Dependency
   name: net-http
   requirement: !ruby/object:Gem::Requirement