bake-gem-github 0.3.0 → 0.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: da7e92debf8a08450ce8af6da25ed171d4961726d5949b9a0c737f3849c613eb
-  data.tar.gz: 85459639500f5e4af61e4d305fe0442ddff853bb8530952385e89db39db6e69c
+  metadata.gz: 46cf12965bbeacaeb560e4ea719f9976543dca995fc1fde8a472ecb534327cd2
+  data.tar.gz: 0c8f8748fd2ef7c93bd3e6dd4ea185165db0e24209c8b33a176b0a58d00b9b41
 SHA512:
-  metadata.gz: 3919da7f3c6101666341e4d9af3b4176e400a2684b3f7cc996f8c04450b1398701512a5e5bbc9c00155d149178c1d17fc056353187a99789be8a4ab9c9a50ebb
-  data.tar.gz: 22dbd706b01561188cb1ccf8aece57b417b6e8a5edef01c22efb0ee883c41048602a356a5b0abc91cac81b24d600bd9d6e37c8d47fe1dd13a71865336cdc94e5
+  metadata.gz: 0db75dbe12482f9f9c601d6f2f8e473832186de8a1609e17f94b9c4876f90234e6273a4cf0d4a4a003ad9457591bd1d00f6aacb7de0bc5cddf621e61c76c5307
+  data.tar.gz: b0d57a706b49d95cccb9023efb014399c1039bc1a38528643e8aa7046516fe4341c2fdc9ac10d097a4429d23ecf7d19d6b5abdca5b3e048e3791eb80f9cda09d

data/bake/gem/github/release.rb

@@ -26,16 +26,21 @@ def major(refresh: false)
 	Bake::Gem::GitHub::Project.new(context.root).prepare(context, "major", refresh: refresh)
 end
 
-# Resolve and validate a merged PR, emitting a commit output for the publishing job.
-# @parameter number [String] The merged PR number; defaults to `RELEASE_PR`.
+# Resolve and validate a pushed commit, emitting its merged PR and commit for publishing.
+# @parameter number [String | Nil] A merged PR number for older workflows; defaults to `RELEASE_PR`.
+# @parameter commit [String | Nil] The pushed commit SHA; defaults to `RELEASE_COMMIT` and takes precedence over `number`.
 # @returns [Hash | Nil] Release metadata, or nil for an ordinary PR.
-def resolve(number: ENV.fetch("RELEASE_PR"))
-	result = Bake::Gem::GitHub::Project.new(context.root).inspect_release(number)
+def resolve(number: ENV["RELEASE_PR"], commit: ENV["RELEASE_COMMIT"])
+	project = Bake::Gem::GitHub::Project.new(context.root)
+	result = commit ? project.inspect_commit(commit) : project.inspect_release(number)
 	
 	if path = ENV["GITHUB_OUTPUT"]
 		File.open(path, "a") do |file|
 			file.puts "release=#{!result.nil?}"
-			file.puts "commit=#{result.fetch(:commit)}" if result
+			if result
+				file.puts "commit=#{result.fetch(:commit)}"
+				file.puts "pull_request=#{result.fetch(:pull_request)}"
+			end
 		end
 	end
 	

data/context/getting-started.md

@@ -4,7 +4,7 @@ This guide explains how to configure reviewed Ruby gem releases and prepare the
 
 ## How releases work
 
-Maintainers prepare a release PR containing the version bump and generated release notes. CI regenerates those changes from the current base to verify the content. Native GitHub rules control approval and merging; after merge, GitHub Actions builds the exact merged commit and publishes its verified artifact to RubyGems.
+Maintainers prepare a release PR containing the version bump and generated release notes. CI regenerates those changes from the current base to verify the content. Native GitHub rules control approval and merging. A push to the default branch starts release inspection; GitHub Actions builds the exact pushed commit only when it is a validated, merged release PR, then publishes its verified artifact to RubyGems.
 
 `bake-gem` provides version updates, release hooks, and clean builds. `bake-gem-github` adds PR preparation, GitHub policy, and remote publishing. The supported process uses one gemspec, stable three-part versions, merge or squash merging, and RubyGems.org.
 
@@ -69,10 +69,14 @@ reviewers:
 
 Replace `your-org/managers` with your organization and team slug, for example `socketry/managers`. Individual user logins are also supported. Reviewers need at least read access to the repository. Setup resolves their GitHub IDs without changing repository access or team membership.
 
+Reviewer teams must have **Visible** visibility in GitHub team settings. Plan and apply reject **Secret** teams before changing any settings, because GitHub can silently discard them from the environment reviewer list. Setup does not change team visibility.
+
 GitHub accepts one to six users or teams, and **one approval from any listed reviewer or team member is sufficient**. It does not support a minimum environment approval count. The default two PR approvals are independent of this publishing approval.
 
 Create the environment and restrict its deployment branch as described above before running plan or apply with reviewers configured. The plan previews the current and desired environment settings. Apply replaces its reviewer list while preserving its wait timer, self-review prevention, administrator bypass setting, and deployment branch restrictions. Custom deployment protection rules are managed separately and are not modified. Reapplying an identical reviewer list leaves the environment unchanged.
 
+After updating the environment, apply reads its settings back and fails if the reviewer identities or preserved protections differ from the requested configuration. Reviewer order does not matter. Earlier updates may already have completed; inspect the environment in GitHub and rerun `gem:github:setup:plan` before retrying apply.
+
 Omitting `reviewers` leaves environment settings unmanaged, including any existing reviewer requirement. An empty list is rejected. To remove an existing requirement, change the environment settings explicitly in GitHub.
 
 The RubyGems Trusted Publisher must explicitly require the `rubygems` environment; leaving that field blank would allow this trusted publisher to authenticate jobs without the environment approval. Keep administrator bypass enabled if administrators should be able to explicitly authorize publication without a reviewer. Environment approvals are available for public repositories on GitHub Free.
@@ -111,6 +115,8 @@ git diff
 
 This updates managed files in the working tree and returns their changed paths. Review the diff and selectively retain repository customizations before committing. The task does not stage, commit, or change remote settings. Repeated updates produce no further changes unless customizations differ from the templates. Apply changed rulesets after the corresponding workflows are running.
 
+Regenerate existing workflows to adopt publishing on `push` instead of `pull_request_target`. The workflow filename and `rubygems` environment remain the same, so the RubyGems Trusted Publisher configuration does not change. No exception to GitHub's `pull_request_target` execution policy is needed. The resolve task continues to accept PR numbers from older workflows while you migrate.
+
 The release workflows follow `bake modernize` action versions and use moving major tags where available. The RubyGems credentials action uses its [documented `@main` reference](https://github.com/rubygems/configure-rubygems-credentials#trusted-publisher-recommended). Repositories that require fixed revisions can customize these references.
 
 ## Current scope

data/context/preparing-releases.md

@@ -21,6 +21,14 @@ Replace `patch` with `minor` or `major`. The wrapper fetches the default branch
 
 All release changes belong in the PR. Core preparation commits additions and deletions from release hooks but never pushes, tags or publishes. Validation independently generates the expected tree from the current base. A changed base SHA alone is fine; changed generated notes are not. Ordinary PRs with no version change pass release validation and still build unsigned.
 
+## Publish the merged release
+
+Merging into the configured default branch triggers `release-publish.yaml` through its `push` event. Inspection uses the exact pushed SHA and resolves its associated PR through GitHub. Publication requires one matching merged PR in this repository, targeting the configured branch, with that exact merge commit. Ordinary changes do not publish; release changes without a matching merged PR fail inspection. Both merge commits and squash merges are supported, including merged fork PRs.
+
+Each release must land as the tip of its own push, as it does when merging a PR through GitHub. Later pushes do not change a pending release's source: inspection and publishing remain pinned to the original commit, and reruns use the same event. Do not combine a release and later changes into one direct push. If you automate merging, use a GitHub App or personal access token; pushes made using a workflow's `GITHUB_TOKEN` do not trigger another workflow.
+
+Only validated releases enter the publishing queue and request approval from the `rubygems` environment when required. Ordinary pushes cannot replace them in that queue. The publishing job retains the existing signing, attestation, and artifact recovery checks.
+
 ## Resume interrupted preparation
 
 If preparation stops after creating or pushing the release branch, return to the current default branch and repeat the same command. The existing branch is validated and reused, so retries do not create a second version bump or PR. Resolve any uncommitted changes before switching branches.

data/context/recovering-releases.md

@@ -24,4 +24,6 @@ A rerun can recover an interrupted individual asset upload once `release.tar` is
 
 ## Understand workflow reruns
 
-GitHub concurrency does not guarantee a durable FIFO queue: rerun any publishing run displaced while pending. Resume reruns all jobs, including integrity checks; it does not repeat or second-guess the native review policy or a permitted administrator bypass. Older publishing runs execute their original code; adding this recovery support to the default branch does not change an already-triggered workflow.
+Only publishing jobs share a concurrency group. They use `queue: max`, allowing up to 100 pending publishing jobs without replacing earlier ones; ordinary pushes only run inspection and do not enter this queue. GitHub cancels additional jobs if that limit is reached. Rerun a canceled publishing workflow after capacity becomes available.
+
+Resume reruns all jobs against the original pushed commit, including integrity checks; it does not repeat or second-guess the native review policy or a permitted administrator bypass. Older publishing runs execute their original code and concurrency policy; updating the default branch does not change an already-triggered workflow.

data/lib/bake/gem/github/project.rb

@@ -111,10 +111,12 @@ module Bake
 				
 				# Resolve release identity; ordinary merged PRs do not publish.
 				# @parameter number [String | Integer] The merged PR number.
+				# @parameter commit [String | Nil] The expected merge commit, when resolving a push event.
 				# @returns [Hash | Nil] Release metadata with symbol keys, or nil for an ordinary PR. Includes `name`, `version`, `commit`, `base`, `bump`, `repository`, `pull_request`, `merged_by`, and `pull_request_url`.
 				# @raises [RuntimeError] If the merged source does not match the independently generated release.
-				def inspect_release(number)
+				def inspect_release(number, commit: nil)
 					pr = merged(number)
+					raise "PR merge commit does not match the pushed commit." if commit && pr.fetch("merge_commit_sha") != commit
 					
 					commit = pr.fetch("merge_commit_sha")
 					metadata = @release.validate(base: "#{commit}^1", candidate: commit, optional: true)
@@ -128,8 +130,34 @@ module Bake
 					end
 				end
 				
+				# Resolve a pushed release commit to the PR which merged it into the configured branch.
+				# @parameter commit [String] The full commit SHA from the push event.
+				# @returns [Hash | Nil] Release metadata from {inspect_release}, or nil for an ordinary change.
+				# @raises [RuntimeError] If the commit is invalid or a release has no unique matching merged PR.
+				# @raises [Bake::Gem::CommandExecutionError] If Git or GitHub cannot verify the release.
+				def inspect_commit(commit)
+					raise "Expected a full pushed commit SHA." unless commit.match?(/\A(?:[0-9a-f]{40}|[0-9a-f]{64})\z/)
+					responses = readlines(
+						"gh", "api", "repos/#{@repository}/commits/#{commit}/pulls?per_page=100",
+						"--paginate", "--slurp", chdir: @root,
+					)
+					pulls = JSON.parse(responses.join).flatten(1).select do |pr|
+						pr["merged_at"] && pr["merge_commit_sha"] == commit &&
+							pr.dig("base", "ref") == @config.fetch("branch") && pr.dig("base", "repo", "full_name") == @repository
+					end
+					
+					if pulls.empty?
+						return nil unless @release.validate(base: "#{commit}^1", candidate: commit, optional: true)
+						raise "Release commit has no matching merged PR."
+					end
+					raise "Multiple merged PRs match the pushed commit." if pulls.size > 1
+					
+					return inspect_release(pulls.first.fetch("number"), commit: commit)
+				end
+				
 				# Return a read-only comparison of managed settings and current repository settings.
 				# @returns [Hash] Desired rules, existing rules, environments, optional environment changes, and expected Trusted Publisher settings. This does not verify RubyGems ownership or publisher configuration.
+				# @raises [RuntimeError] If a reviewer team is secret or belongs to another organization.
 				def doctor
 					{
 						desired_rules: Setup.rules(@config),
@@ -147,8 +175,9 @@ module Bake
 				
 				# Apply the named rulesets and configured reviewers for an existing environment. Invoke after reviewing doctor output.
 				# Preserves the environment's wait timer, self-review prevention, administrator bypass, and branch restrictions.
+				# Reads back updated environment settings to verify GitHub retained them.
 				# @returns [Hash] The desired ruleset payloads after successful application.
-				# @raises [RuntimeError] If more than one existing ruleset has a managed name.
+				# @raises [RuntimeError] If a reviewer team is unsuitable, managed rulesets are ambiguous, or environment verification fails. Earlier updates may already have completed.
 				# @raises [Bake::Gem::CommandExecutionError] If an API operation fails; earlier updates may already have completed.
 				def apply
 					changes = environment_changes
@@ -166,6 +195,9 @@ module Bake
 					
 					if changes && changes.fetch(:current) != changes.fetch(:desired)
 						write_api("repos/#{@repository}/#{environment_path}", changes.fetch(:desired), method: "PUT")
+						unless environment_settings == changes.fetch(:desired)
+							raise "GitHub did not retain the requested settings for environment #{changes.fetch(:name)}. Check its reviewers and protection rules in GitHub, then rerun gem:github:setup:plan."
+						end
 					end
 					
 					return rules
@@ -182,19 +214,26 @@ module Bake
 					return nil unless @config.key?("reviewers")
 					Setup.validate_reviewers(@config["reviewers"])
 					
+					current = environment_settings
+					reviewers = @config.fetch("reviewers").map{|name| resolve_reviewer(name)}.uniq.sort_by{|reviewer| reviewer.values_at(:type, :id)}
+					
+					return {name: @config.fetch("environment"), current: current, desired: current.merge(reviewers: reviewers)}
+				end
+				
+				# Read the environment settings, comparing reviewer identities independently of their order.
+				def environment_settings
 					environment = api(environment_path)
 					protections = environment.fetch("protection_rules").to_h{|rule| [rule.fetch("type"), rule]}
 					reviews = protections.fetch("required_reviewers", {})
-					current = {
+					reviewers = reviews.fetch("reviewers", []).map{|entry| {type: entry.fetch("type"), id: entry.fetch("reviewer").fetch("id")}}
+					
+					return {
 						wait_timer: protections.fetch("wait_timer", {}).fetch("wait_timer", 0),
 						prevent_self_review: reviews.fetch("prevent_self_review", false),
 						can_admins_bypass: environment.fetch("can_admins_bypass"),
 						deployment_branch_policy: environment.fetch("deployment_branch_policy"),
-						reviewers: reviews.fetch("reviewers", []).map{|entry| {type: entry.fetch("type"), id: entry.fetch("reviewer").fetch("id")}},
+						reviewers: reviewers.uniq.sort_by{|reviewer| reviewer.values_at(:type, :id)},
 					}
-					reviewers = @config.fetch("reviewers").map{|name| resolve_reviewer(name)}
-					
-					return {name: @config.fetch("environment"), current: current, desired: current.merge(reviewers: reviewers)}
 				end
 				
 				def resolve_reviewer(name)
@@ -208,6 +247,9 @@ module Bake
 						type = "User"
 					end
 					response = JSON.parse(readlines("gh", "api", path, chdir: @root).join)
+					if type == "Team" && response.fetch("privacy") == "secret"
+						raise "Reviewer team #{name} is Secret. Change its visibility to Visible in GitHub team settings before running setup."
+					end
 					
 					return {type: type, id: response.fetch("id")}
 				end

data/lib/bake/gem/github/version.rb

@@ -9,7 +9,7 @@ module Bake
 	module Gem
 		# GitHub pull request and release orchestration for bake-gem.
 		module GitHub
-			VERSION = "0.3.0"
+			VERSION = "0.4.0"
 		end
 	end
 end

data/readme.md

@@ -24,6 +24,15 @@ Please see the [project documentation](https://socketry.github.io/bake-gem-githu
 
 Please see the [project releases](https://socketry.github.io/bake-gem-github/releases/index) for all releases.
 
+### v0.4.0
+
+  - Reject Secret environment reviewer teams before applying release settings, and verify that GitHub retained the requested reviewers and existing protections after updating the environment.
+
+### v0.3.1
+
+  - Publish validated release PRs from pushes to the default branch, retaining the exact merged commit and environment approval without requiring `pull_request_target`.
+  - Queue publishing jobs without replacing pending releases when later changes land.
+
 ### v0.3.0
 
   - Configure publishing environment reviewers through release setup while preserving existing environment protections.

data/releases.md

@@ -1,5 +1,14 @@
 # Releases
 
+## v0.4.0
+
+  - Reject Secret environment reviewer teams before applying release settings, and verify that GitHub retained the requested reviewers and existing protections after updating the environment.
+
+## v0.3.1
+
+  - Publish validated release PRs from pushes to the default branch, retaining the exact merged commit and environment approval without requiring `pull_request_target`.
+  - Queue publishing jobs without replacing pending releases when later changes land.
+
 ## v0.3.0
 
   - Configure publishing environment reviewers through release setup while preserving existing environment protections.

data/templates/release-prepare.yaml.erb

@@ -40,7 +40,7 @@ jobs:
           bundler-cache: true
       - name: Create release PR
         env:
-          GH_TOKEN: ${{ github.token }}
+          GITHUB_TOKEN: ${{ github.token }}
           BUMP: ${{ inputs.bump }}
           REFRESH: ${{ inputs.refresh }}
         run: |

data/templates/release-publish.yaml.erb

@@ -1,34 +1,28 @@
 name: Publish release
 
-# Only merged source is executed. Validation of unmerged PRs lives in its own
-# read-only pull_request workflow. This trigger also supports reviewed fork PRs.
+# Inspect the exact pushed commit and publish only a validated, merged release PR.
 on:
-  pull_request_target:
-    types: [closed]
+  push:
     branches: [<%= branch.to_json %>]
 
 permissions:
   contents: read
   pull-requests: read
 
-concurrency:
-  group: release-publish
-  cancel-in-progress: false
-
 env:
   BUNDLE_WITH: maintenance
-  RELEASE_PR: ${{ github.event.pull_request.number }}
 
 jobs:
   inspect:
-    if: github.event.pull_request.merged == true
     runs-on: ubuntu-latest
     outputs:
       release: ${{ steps.inspect.outputs.release }}
       commit: ${{ steps.inspect.outputs.commit }}
+      pull_request: ${{ steps.inspect.outputs.pull_request }}
     steps:
       - uses: actions/checkout@v7
         with:
+          ref: ${{ github.sha }}
           fetch-depth: 0
           persist-credentials: false
       - uses: ruby/setup-ruby@v1
@@ -37,7 +31,8 @@ jobs:
           bundler-cache: true
       - id: inspect
         env:
-          GH_TOKEN: ${{ github.token }}
+          GITHUB_TOKEN: ${{ github.token }}
+          RELEASE_COMMIT: ${{ github.sha }}
         run: bundle exec bake gem:github:release:resolve
 
   publish:
@@ -45,6 +40,12 @@ jobs:
     if: needs.inspect.outputs.release == 'true'
     runs-on: ubuntu-latest
     environment: rubygems
+    concurrency:
+      group: release-publish
+      cancel-in-progress: false
+      queue: max
+    env:
+      RELEASE_PR: ${{ needs.inspect.outputs.pull_request }}
     permissions:
       contents: write
       pull-requests: read
@@ -55,8 +56,6 @@ jobs:
       - uses: actions/checkout@v7
         with:
           # Inspection verified this merged commit belongs to the default branch.
-          # Checkout v7 also blocks merged fork PRs without this explicit opt-in.
-          allow-unsafe-pr-checkout: true
           ref: ${{ needs.inspect.outputs.commit }}
           fetch-depth: 0
           persist-credentials: false
@@ -68,7 +67,7 @@ jobs:
       - name: Build or restore artifact
         id: build
         env:
-          GH_TOKEN: ${{ github.token }}
+          GITHUB_TOKEN: ${{ github.token }}
 <% if signing -%>
           GEM_SIGNING_KEY: ${{ secrets.GEM_SIGNING_KEY }}
 <% end -%>
@@ -102,5 +101,5 @@ jobs:
       - uses: rubygems/configure-rubygems-credentials@main
       - name: Verify, publish, and finalize
         env:
-          GH_TOKEN: ${{ github.token }}
+          GITHUB_TOKEN: ${{ github.token }}
         run: bundle exec bake gem:github:release:publish

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: bake-gem-github
 version: !ruby/object:Gem::Version
-  version: 0.3.0
+  version: 0.4.0
 platform: ruby
 authors:
 - Samuel Williams