bake-gem-github 0.5.0 → 0.6.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4f7557669b8ec839c193fbf060816c360413ba4be3cd8e223f294acb8e29baed
-  data.tar.gz: c4806b56446c74082b785e6f19ac8a36cfbe1cd79a07ba05eda3bcd223ceaeb8
+  metadata.gz: 46e9578ab60761af87b7130ba3642b00401e89febdcd7e8cced97d74252e37b6
+  data.tar.gz: 53997e6e60991e6e5b057cd62ee7897de5156306d4dceb3d8a6bef2a269cd349
 SHA512:
-  metadata.gz: 522b233facca2afd17c28320ee34de988053bc33832a595c4e54ad34a308997813d54afaf43aa8a6c6b785b0a882b0f953aa5fecd7c4d004c0d4a21180d8f9b7
-  data.tar.gz: 7d4dbe694f2209d5a369c2e8100101a824b1cc0839023dd4a58976b9022154428c6e7e87ab8185b70f17e7913746f07bf4abdeabd4145c510ade5c3b8ba44ee3
+  metadata.gz: bef7899e4fbd943cd791a72562739f04e8831f5c1fbc7b4760426c48bb9b99bf6fb96d931de8399423203d147b6775c65f137392b9e55ae7761fcb733aa00cb8
+  data.tar.gz: 28a9ccd6198bb07906119a6b89cf0fa23874756a5dcc53d335032bb94eebc5843b79b3f843a4ac5cfb6c911c7fd372a52095e9618d37b2bc5820c7ef463ff8c0

data/bake/gem/github/setup.rb

@@ -4,9 +4,29 @@
 # Copyright, 2026, by Samuel Williams.
 
 # Inspect external settings before applying the generated policy.
+# @parameter publisher [Boolean] Authenticate to RubyGems and check the expected publisher registration.
+# @parameter key [Symbol] An explicitly selected RubyGems API key name.
+# @parameter otp [String] An optional RubyGems MFA code.
 # @returns [Hash] Desired and observed settings for review.
-def plan
-	context.lookup("gem:github:doctor").call
+def plan(publisher: false, key: nil, otp: nil)
+	result = context.lookup("gem:github:doctor").call
+	if publisher
+		require "bake/gem/github/trusted_publisher"
+		
+		result[:trusted_publisher_status] = Bake::Gem::GitHub::TrustedPublisher.load(context.root, key: key, otp: otp).status
+	end
+	
+	return result
+end
+
+# Register the configured release workflow as a trusted publisher for an existing gem on RubyGems.org.
+# @parameter key [Symbol] An explicitly selected RubyGems API key name.
+# @parameter otp [String] An optional RubyGems MFA code.
+# @returns [Hash] Whether the publisher was created and its API record.
+def publisher(key: nil, otp: nil)
+	require "bake/gem/github/trusted_publisher"
+	
+	Bake::Gem::GitHub::TrustedPublisher.load(context.root, key: key, otp: otp).register
 end
 
 # Apply the four managed rulesets and configured environment reviewers using the current gh administrator credentials.

data/context/getting-started.md

@@ -48,9 +48,25 @@ The rules require two approvals by default, allow explicit administrator bypass,
 
 ## Configure publishing credentials
 
-Create a `rubygems` GitHub environment restricted to the default branch. On RubyGems, an owner must configure a Trusted Publisher with the values printed by `gem:github:setup:plan`: the owner/repository, workflow filename **`release-publish.yaml`**, and environment **`rubygems`**. See [RubyGems Trusted Publishing](https://guides.rubygems.org/trusted-publishing/) for the account setup.
+Create a `rubygems` GitHub environment restricted to the default branch. For an existing gem on RubyGems.org, run this task from the repository root as a gem owner:
 
-Ownership, MFA, and signing bootstrap are manual setup steps. The plan reports expected RubyGems values; it does not verify ownership or publisher trust. Trusted Publishing supplies the publishing credential for each run, so a long-lived RubyGems API key is unnecessary.
+``` bash
+bundle exec bake gem:github:setup:publisher
+```
+
+The task reads the gem name from its gemspec and the owner/repository and environment from `config/release.yaml`. It registers the **`release-publish.yaml`** workflow with the configured environment (**`rubygems`** by default). An exact existing match is reused, so reruns do not create duplicate registrations. Other publishers are preserved; the task does not remove or replace them.
+
+Without an explicitly supplied API key, the task prompts for RubyGems credentials and any required MFA verification. It requests a key with only the `configure_trusted_publishers` scope, expiring after 15 minutes, and keeps it in memory. It does not read or overwrite your default saved push key. To use an existing key with this scope, supply `GEM_HOST_API_KEY` or select a named RubyGems credential with `key=publisher`. Registration and the optional plan check also accept `otp=123456` or `GEM_HOST_OTP_CODE` when needed.
+
+To check registration without creating a publisher:
+
+``` bash
+bundle exec bake gem:github:setup:plan publisher=true
+```
+
+This adds `trusted_publisher_status` to the plan, including `configured` and the matching registration. The default plan only reports expected RubyGems values and does not authenticate to RubyGems. Authentication, ownership, and API failures stop the task rather than being reported as a missing registration.
+
+For a gem that has never been published, configure a pending publisher manually. Account ownership, MFA enrollment, the GitHub environment, and signing bootstrap remain manual setup steps. See [RubyGems Trusted Publishing](https://guides.rubygems.org/trusted-publishing/) for account setup. Trusted Publishing supplies the publishing credential for each release, so a long-lived RubyGems API key is unnecessary.
 
 When `release.cert` exists, setup enables certificate signing. Commit the public certificate and install its matching private key as `GEM_SIGNING_KEY`, either in the `rubygems` environment or as an organization secret available to the repository. The publisher checks certificate validity, key matching, and package signatures. Use `signing=false` during setup to disable certificate signing.
 

data/lib/bake/gem/github/project.rb

@@ -181,12 +181,18 @@ module Bake
 						existing_rules: api("rulesets?per_page=100"),
 						environments: api("environments"),
 						environment_changes: environment_changes,
-						trusted_publisher: {
-							repository_owner: @repository.split("/").first,
-							repository_name: @repository.split("/").last,
-							workflow_filename: "release-publish.yaml",
-							environment: @config.fetch("environment"),
-						}
+						trusted_publisher: trusted_publisher,
+					}
+				end
+				
+				# Describe the RubyGems publisher for the reviewed release workflow.
+				# @returns [Hash] Repository, workflow filename, and environment settings.
+				def trusted_publisher
+					{
+						repository_owner: @repository.split("/").first,
+						repository_name: @repository.split("/").last,
+						workflow_filename: "release-publish.yaml",
+						environment: @config.fetch("environment"),
 					}
 				end
 				

data/lib/bake/gem/github/trusted_publisher.rb

@@ -0,0 +1,124 @@
+# frozen_string_literal: true
+
+# Released under the MIT License.
+# Copyright, 2026, by Samuel Williams.
+
+require "json"
+require "rubygems/gemcutter_utilities"
+require "rubygems/user_interaction"
+require "uri"
+require_relative "project"
+
+module Bake
+	module Gem
+		module GitHub
+			# Registers the reviewed release workflow with RubyGems.org using its owner API.
+			class TrustedPublisher
+				include ::Gem::UserInteraction
+				include ::Gem::GemcutterUtilities
+				
+				# The RubyGems API scope for managing trusted publishers.
+				SCOPE = :configure_trusted_publishers
+				
+				# The provider type accepted by the RubyGems trusted publisher API.
+				TYPE = "OIDC::TrustedPublisher::GitHubAction"
+				
+				# Load the gem identity and reviewed publisher settings from the current project.
+				# @parameter root [String] The repository root, which must also be the working directory.
+				# @parameter options [Hash] Authentication options passed to {initialize}.
+				# @returns [TrustedPublisher] The configured RubyGems client.
+				def self.load(root, **options)
+					project = Project.new(root)
+					name = Helper.new(root).gemspec.name
+					
+					new(name, project.trusted_publisher, **options)
+				end
+				
+				# Configure an existing gem's expected GitHub Actions publisher.
+				# @parameter name [String] The gem name.
+				# @parameter settings [Hash] Repository owner/name, workflow filename, and environment.
+				# @parameter key [Symbol | Nil] An explicitly selected key in RubyGems credentials.
+				# @parameter otp [String | Nil] An optional MFA code; RubyGems can prompt when required.
+				def initialize(name, settings, key: nil, otp: nil)
+					@path = "api/v1/gems/#{URI.encode_www_form_component(name)}/trusted_publishers"
+					@settings = settings.transform_keys(&:to_s)
+					@options = {key: key, otp: otp}
+					@host = "https://rubygems.org"
+					@api_key = nil
+				end
+				
+				# @attribute [Hash] Options used by RubyGems authentication and MFA support.
+				attr_reader :options
+				
+				# Read the matching publisher without changing publisher configuration.
+				# @returns [Hash] Whether the publisher is configured and its existing API record, if any.
+				# @raises [RuntimeError] If RubyGems cannot list the gem's publishers.
+				def status
+					sign_in(scope: SCOPE) unless api_key
+					publishers = request(:get, expected: "200")
+					raise "Invalid RubyGems trusted publishers response." unless publishers.is_a?(Array)
+					publisher = publishers.find{|record| matching?(record)}
+					
+					return {configured: !publisher.nil?, publisher: publisher}
+				end
+				
+				# Register a missing publisher, preserving all existing publisher registrations.
+				# @returns [Hash] Whether registration was created and the matching API record.
+				# @raises [RuntimeError] If RubyGems rejects registration or returns different settings.
+				def register
+					current = status
+					return {created: false, publisher: current.fetch(:publisher)} if current.fetch(:configured)
+					
+					publisher = request(:post, expected: "201", payload: {trusted_publisher_type: TYPE, trusted_publisher: @settings})
+					raise "RubyGems returned unexpected trusted publisher settings." unless matching?(publisher)
+					
+					return {created: true, publisher: publisher}
+				end
+				
+				# Use the session key or an explicitly supplied credential, leaving the default push key alone.
+				# @returns [String | Nil] The API key used for this session.
+				def api_key
+					@api_key || ENV["GEM_HOST_API_KEY"] || (options[:key] && verify_api_key(options[:key]))
+				end
+				
+				# Keep newly issued credentials in memory rather than changing the user's credentials file.
+				# @parameter host [String] The authenticated RubyGems host.
+				# @parameter key [String] The newly issued API key.
+				def set_api_key(host, key)
+					@api_key = key
+				end
+				
+				private
+				
+				def get_mfa_params(profile)
+					super.merge(expires_at: (Time.now.utc + 900).strftime("%Y-%m-%d %H:%M:%S UTC"))
+				end
+				
+				def matching?(record)
+					return false unless record.fetch("trusted_publisher_type") == TYPE
+					settings = record.fetch("trusted_publisher")
+					
+					# Generated publishing workflows run in the configured repository, not a reusable workflow repository:
+					@settings.all?{|key, value| settings[key] == value} &&
+						settings["workflow_repository_owner"].nil? && settings["workflow_repository_name"].nil?
+				end
+				
+				def request(method, expected:, payload: nil)
+					response = rubygems_api_request(method, @path, scope: SCOPE) do |request|
+						request["Authorization"] = api_key
+						request["Accept"] = "application/json"
+						if payload
+							request["Content-Type"] = "application/json"
+							request.body = JSON.generate(payload)
+						end
+					end
+					unless response.code == expected
+						raise "RubyGems trusted publisher #{method.to_s.upcase} failed (HTTP #{response.code}): #{clean_text(response.body)}"
+					end
+					
+					JSON.parse(response.body)
+				end
+			end
+		end
+	end
+end

data/lib/bake/gem/github/version.rb

@@ -9,7 +9,7 @@ module Bake
 	module Gem
 		# GitHub pull request and release orchestration for bake-gem.
 		module GitHub
-			VERSION = "0.5.0"
+			VERSION = "0.6.0"
 		end
 	end
 end

data/readme.md

@@ -24,6 +24,11 @@ Please see the [project documentation](https://socketry.github.io/bake-gem-githu
 
 Please see the [project releases](https://socketry.github.io/bake-gem-github/releases/index) for all releases.
 
+### v0.6.0
+
+  - Register RubyGems trusted publishers from the gemspec and release configuration with `gem:github:setup:publisher`, reusing existing registrations and RubyGems authentication/MFA support.
+  - Check publisher registration explicitly with `gem:github:setup:plan publisher=true`.
+
 ### v0.5.0
 
   - Support rebase merging by requiring each release PR to contain exactly one commit, while leaving ordinary PRs unrestricted. Generated rules allow merge, squash, and rebase methods according to repository settings.

data/releases.md

@@ -1,5 +1,10 @@
 # Releases
 
+## v0.6.0
+
+  - Register RubyGems trusted publishers from the gemspec and release configuration with `gem:github:setup:publisher`, reusing existing registrations and RubyGems authentication/MFA support.
+  - Check publisher registration explicitly with `gem:github:setup:plan publisher=true`.
+
 ## v0.5.0
 
   - Support rebase merging by requiring each release PR to contain exactly one commit, while leaving ordinary PRs unrestricted. Generated rules allow merge, squash, and rebase methods according to repository settings.

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: bake-gem-github
 version: !ruby/object:Gem::Version
-  version: 0.5.0
+  version: 0.6.0
 platform: ruby
 authors:
 - Samuel Williams
@@ -107,6 +107,7 @@ files:
 - lib/bake/gem/github/publisher.rb
 - lib/bake/gem/github/registry.rb
 - lib/bake/gem/github/setup.rb
+- lib/bake/gem/github/trusted_publisher.rb
 - lib/bake/gem/github/version.rb
 - license.md
 - readme.md