bake-gem-github 0.5.0 → 0.7.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4f7557669b8ec839c193fbf060816c360413ba4be3cd8e223f294acb8e29baed
-  data.tar.gz: c4806b56446c74082b785e6f19ac8a36cfbe1cd79a07ba05eda3bcd223ceaeb8
+  metadata.gz: 6806efc908e7db5189295eb013a2d29bc3f82a20b9749eafc9464baa898a251a
+  data.tar.gz: 19143737be1d10805c3204064234880fe49b2b33ba107cb55676c522a83fd5e1
 SHA512:
-  metadata.gz: 522b233facca2afd17c28320ee34de988053bc33832a595c4e54ad34a308997813d54afaf43aa8a6c6b785b0a882b0f953aa5fecd7c4d004c0d4a21180d8f9b7
-  data.tar.gz: 7d4dbe694f2209d5a369c2e8100101a824b1cc0839023dd4a58976b9022154428c6e7e87ab8185b70f17e7913746f07bf4abdeabd4145c510ade5c3b8ba44ee3
+  metadata.gz: 7ec509f5bc2921c554352950a9c469dcbe8dccc8f64bfd0e71fcfdb237855c68c1d0a232fcbea6e816204cb37868d952a11b8b0bf97d1ca3e6c0b9e7cfb22f8d
+  data.tar.gz: 8bfb262d1cfcb69db13aa8075fb354d1dbf70826c03a04747bd7cba1e80b4c04a18d16ff147c150727c78a2c88deb4ff8a8a63498a024bfcff31d62adddbb572

data/bake/gem/github/setup.rb

@@ -4,9 +4,29 @@
 # Copyright, 2026, by Samuel Williams.
 
 # Inspect external settings before applying the generated policy.
+# @parameter publisher [Boolean] Authenticate to RubyGems and check the expected publisher registration.
+# @parameter key [Symbol] An explicitly selected RubyGems API key name.
+# @parameter otp [String] An optional RubyGems MFA code.
 # @returns [Hash] Desired and observed settings for review.
-def plan
-	context.lookup("gem:github:doctor").call
+def plan(publisher: false, key: nil, otp: nil)
+	result = context.lookup("gem:github:doctor").call
+	if publisher
+		require "bake/gem/github/trusted_publisher"
+		
+		result[:trusted_publisher_status] = Bake::Gem::GitHub::TrustedPublisher.load(context.root, key: key, otp: otp).status
+	end
+	
+	return result
+end
+
+# Register the configured release workflow as a trusted publisher for an existing gem on RubyGems.org.
+# @parameter key [Symbol] An explicitly selected RubyGems API key name.
+# @parameter otp [String] An optional RubyGems MFA code.
+# @returns [Hash] Whether the publisher was created and its API record.
+def publisher(key: nil, otp: nil)
+	require "bake/gem/github/trusted_publisher"
+	
+	Bake::Gem::GitHub::TrustedPublisher.load(context.root, key: key, otp: otp).register
 end
 
 # Apply the four managed rulesets and configured environment reviewers using the current gh administrator credentials.

data/bake/gem/github.rb

@@ -9,10 +9,9 @@
 # @parameter branch [String] Default branch name; discovered through GitHub when omitted.
 # @parameter approvals [Integer] Number of approving reviews.
 # @parameter reviewers [Array(String)] Publishing environment reviewers: user logins or organization/team names. Omit to leave environment settings unmanaged.
-# @parameter signing [Boolean] Require certificate signing; when omitted, enable it if `release.cert` exists.
 # @parameter ruby [String] Ruby version for release workflows.
 # @returns [Array(String)] Generated paths relative to the repository root.
-def setup(checks:, repository: nil, branch: nil, approvals: 2, reviewers: nil, signing: nil, ruby: "3.4")
+def setup(checks:, repository: nil, branch: nil, approvals: 2, reviewers: nil, ruby: "3.4")
 	require "bake/gem/github/setup"
 	require "bake/gem/shell"
 	
@@ -31,7 +30,6 @@ def setup(checks:, repository: nil, branch: nil, approvals: 2, reviewers: nil, s
 		reviewers: reviewers,
 		ruby: ruby,
 	}
-	options[:signing] = signing unless signing.nil?
 	
 	Bake::Gem::GitHub::Setup.new(context.root).generate(**options)
 end

data/context/getting-started.md

@@ -48,13 +48,29 @@ The rules require two approvals by default, allow explicit administrator bypass,
 
 ## Configure publishing credentials
 
-Create a `rubygems` GitHub environment restricted to the default branch. On RubyGems, an owner must configure a Trusted Publisher with the values printed by `gem:github:setup:plan`: the owner/repository, workflow filename **`release-publish.yaml`**, and environment **`rubygems`**. See [RubyGems Trusted Publishing](https://guides.rubygems.org/trusted-publishing/) for the account setup.
+Create a `rubygems` GitHub environment restricted to the default branch. For an existing gem on RubyGems.org, run this task from the repository root as a gem owner:
 
-Ownership, MFA, and signing bootstrap are manual setup steps. The plan reports expected RubyGems values; it does not verify ownership or publisher trust. Trusted Publishing supplies the publishing credential for each run, so a long-lived RubyGems API key is unnecessary.
+``` bash
+bundle exec bake gem:github:setup:publisher
+```
+
+The task reads the gem name from its gemspec and the owner/repository and environment from `config/release.yaml`. It registers the **`release-publish.yaml`** workflow with the configured environment (**`rubygems`** by default). An exact existing match is reused, so reruns do not create duplicate registrations. Other publishers are preserved; the task does not remove or replace them.
 
-When `release.cert` exists, setup enables certificate signing. Commit the public certificate and install its matching private key as `GEM_SIGNING_KEY`, either in the `rubygems` environment or as an organization secret available to the repository. The publisher checks certificate validity, key matching, and package signatures. Use `signing=false` during setup to disable certificate signing.
+Without an explicitly supplied API key, the task prompts for RubyGems credentials and any required MFA verification. It requests a key with only the `configure_trusted_publishers` scope, expiring after 15 minutes, and keeps it in memory. It does not read or overwrite your default saved push key. To use an existing key with this scope, supply `GEM_HOST_API_KEY` or select a named RubyGems credential with `key=publisher`. Registration and the optional plan check also accept `otp=123456` or `GEM_HOST_OTP_CODE` when needed.
 
-Ensure another maintainer can administer the repository and recover its RubyGems account and signing key.
+To check registration without creating a publisher:
+
+``` bash
+bundle exec bake gem:github:setup:plan publisher=true
+```
+
+This adds `trusted_publisher_status` to the plan, including `configured` and the matching registration. The default plan only reports expected RubyGems values and does not authenticate to RubyGems. Authentication, ownership, and API failures stop the task rather than being reported as a missing registration.
+
+For a gem that has never been published, configure a pending publisher manually. Account ownership, MFA enrollment, and the GitHub environment remain manual setup steps. See [RubyGems Trusted Publishing](https://guides.rubygems.org/trusted-publishing/) for account setup. Trusted Publishing supplies the publishing credential for each release, so a long-lived RubyGems API key is unnecessary.
+
+Publishing builds gems without RubyGems certificate signatures. Sigstore and GitHub provenance attestations bind the package to its source and release workflow; no separate certificate or private signing key is required.
+
+Ensure another maintainer can administer the repository and recover its RubyGems account.
 
 ## Authorize publishing
 
@@ -117,6 +133,8 @@ git diff
 
 This updates managed files in the working tree and returns their changed paths. Review the diff and selectively retain repository customizations before committing. The task does not stage, commit, or change remote settings. Repeated updates produce no further changes unless customizations differ from the templates. Apply changed rulesets after the corresponding workflows are running.
 
+Updating removes the obsolete `signing` configuration and `GEM_SIGNING_KEY` workflow reference. The publisher ignores legacy certificate-signing settings and always builds unsigned packages. Remove `cert_chain`, `signing_key`, and unused public certificates from your gem project when migrating. Attestation verification and RubyGems Trusted Publishing remain required.
+
 To enable rebase merging on an existing installation, regenerate and merge `release-validate.yaml` so it runs `gem:github:release:validate`, which requires single-commit release PRs. Then review `gem:github:setup:plan` and run `gem:github:setup:apply` to allow rebase merging in the managed rules. Enable rebase merging in repository settings as well. Upgrading the gem alone does not update workflows or live rules.
 
 Regenerate existing workflows to adopt publishing on `push` instead of `pull_request_target`. The workflow filename and `rubygems` environment remain the same, so the RubyGems Trusted Publisher configuration does not change. No exception to GitHub's `pull_request_target` execution policy is needed. The resolve task continues to accept PR numbers from older workflows while you migrate.

data/context/preparing-releases.md

@@ -36,7 +36,7 @@ Merging into the configured default branch triggers `release-publish.yaml` throu
 
 Each release must land as the tip of its own push, as it does when merging a PR through GitHub. Later pushes do not change a pending release's source: inspection and publishing remain pinned to the original commit, and reruns use the same event. Do not combine a release and later changes into one direct push. If you automate merging, use a GitHub App or personal access token; pushes made using a workflow's `GITHUB_TOKEN` do not trigger another workflow.
 
-Only validated releases enter the publishing queue and request approval from the `rubygems` environment when required. Ordinary pushes cannot replace them in that queue. The publishing job retains the existing signing, attestation, and artifact recovery checks.
+Only validated releases enter the publishing queue and request approval from the `rubygems` environment when required. Ordinary pushes cannot replace them in that queue. The publishing job retains attestation and artifact recovery checks.
 
 ## Resume interrupted preparation
 

data/context/verifying-releases.md

@@ -6,7 +6,7 @@ Use this when checking a completed release or confirming which source commit pro
 
 ## What publishing verifies
 
-After squash, rebase, or merge, the publishing workflow verifies GitHub's merged PR record and ancestry, then checks out the exact resulting commit. Each release PR contains one commit, so the resulting commit's **first parent** is the default branch immediately before the release landed. Later development on the default branch is allowed. Publishing regenerates against that first parent, builds in a clean worktree, optionally certificate-signs, and creates two attestations over the final bytes:
+After squash, rebase, or merge, the publishing workflow verifies GitHub's merged PR record and ancestry, then checks out the exact resulting commit. Each release PR contains one commit, so the resulting commit's **first parent** is the default branch immediately before the release landed. Later development on the default branch is allowed. Publishing regenerates against that first parent, builds an unsigned gem in a clean worktree, and creates two attestations over the final bytes:
 
 - A Sigstore bundle submitted explicitly with `gem push --attestation` using RubyGems 4.0.21.
 - GitHub's native SLSA provenance covering both the gem and `release.json`. This signed receipt binds the gem digest to the exact release commit, even when the workflow's own default-branch revision is newer.

data/lib/bake/gem/github/project.rb

@@ -181,12 +181,18 @@ module Bake
 						existing_rules: api("rulesets?per_page=100"),
 						environments: api("environments"),
 						environment_changes: environment_changes,
-						trusted_publisher: {
-							repository_owner: @repository.split("/").first,
-							repository_name: @repository.split("/").last,
-							workflow_filename: "release-publish.yaml",
-							environment: @config.fetch("environment"),
-						}
+						trusted_publisher: trusted_publisher,
+					}
+				end
+				
+				# Describe the RubyGems publisher for the reviewed release workflow.
+				# @returns [Hash] Repository, workflow filename, and environment settings.
+				def trusted_publisher
+					{
+						repository_owner: @repository.split("/").first,
+						repository_name: @repository.split("/").last,
+						workflow_filename: "release-publish.yaml",
+						environment: @config.fetch("environment"),
 					}
 				end
 				

data/lib/bake/gem/github/publisher.rb

@@ -8,7 +8,6 @@ require_relative "backup"
 require_relative "registry"
 require "bake/releases"
 require "digest"
-require "openssl"
 
 module Bake
 	module Gem
@@ -28,7 +27,7 @@ module Bake
 				
 				# Build or restore this workflow run's artifact, after validating the actual merged commit.
 				# @parameter number [String | Integer] The merged release PR number.
-				# @returns [Hash] The release receipt. Extends {Project#inspect_release} metadata with `file`, `sha256`, `run_id`, and `signing`; writes the receipt to `pkg/release.json` and Actions outputs when configured.
+				# @returns [Hash] The release receipt. Extends {Project#inspect_release} metadata with `file`, `sha256`, and `run_id`; writes the receipt to `pkg/release.json` and Actions outputs when configured.
 				# @raises [RuntimeError] If the workflow identity, source, or retained artifact is invalid, or published bytes cannot be recovered.
 				def build(number)
 					guard_environment
@@ -165,7 +164,6 @@ module Bake
 						file: filename,
 						sha256: Digest::SHA256.file(package).hexdigest,
 						run_id: run,
-						signing: @config.fetch("signing"),
 					)
 					File.write(File.join(path, "release.json"), JSON.pretty_generate(receipt) + "\n")
 					
@@ -198,10 +196,8 @@ module Bake
 					end
 				end
 				
-				# Verify the optional certificate signature and both attestation formats.
+				# Verify both attestation formats.
 				def verify_artifact(package, bundle)
-					verify_certificate(package) if @config.fetch("signing")
-					
 					identity = "https://github.com/#{@repository}/.github/workflows/release-publish.yaml@refs/heads/#{@config.fetch('branch')}"
 					gem_command(
 						"exec", "sigstore-cli:0.2.3", "verify", package, "--bundle", bundle,
@@ -347,34 +343,8 @@ module Bake
 					raise "Publishing requires the default branch workflow." unless ENV["GITHUB_REF"] == "refs/heads/#{@config.fetch('branch')}"
 				end
 				
-				def verify_certificate(path)
-					policy = ::Gem::Security::Policy.new("Release", only_trusted: false)
-					package = ::Gem::Package.new(path, policy)
-					package.verify
-					
-					signer = OpenSSL::X509::Certificate.new(package.spec.cert_chain.last)
-					expected = OpenSSL::X509::Certificate.new(File.read(File.join(@root, "release.cert")))
-					raise "Package signer differs from release.cert." unless signer.to_der == expected.to_der
-				end
-				
 				def build_package(path)
-					unless @config.fetch("signing")
-						return @release.worktree("HEAD"){|source| @release.bake(source, "gem:build", root: path, signing_key: false)}
-					end
-					
-					certificate = OpenSSL::X509::Certificate.new(File.read(File.join(@root, "release.cert")))
-					key = OpenSSL::PKey.read(ENV.fetch("GEM_SIGNING_KEY"))
-					raise "Signing key does not match release.cert." unless certificate.check_private_key(key)
-					raise "Signing certificate is not currently valid." unless (certificate.not_before..certificate.not_after).cover?(Time.now)
-					
-					return Tempfile.create("gem-signing-key") do |file|
-						file.chmod(0600)
-						file.write(ENV.fetch("GEM_SIGNING_KEY"))
-						file.flush
-						package = @release.worktree("HEAD"){|source| @release.bake(source, "gem:build", root: path, signing_key: file.path)}
-						verify_certificate(package)
-						package
-					end
+					return @release.worktree("HEAD"){|source| @release.bake(source, "gem:build", root: path, signing_key: false)}
 				end
 				
 				def output(receipt, restored:)

data/lib/bake/gem/github/setup.rb

@@ -24,11 +24,10 @@ module Bake
 				# @parameter checks [Array(String)] Required CI job names; release validation is added automatically.
 				# @parameter approvals [Integer] Required approvals, between one and six.
 				# @parameter reviewers [Array(String) | Nil] Publishing environment reviewers, as user logins or organization/team names. Nil leaves environment settings unmanaged.
-				# @parameter signing [Boolean] Whether publishing requires the certificate and matching private key.
 				# @parameter ruby [String] The Ruby version used by release workflows.
 				# @returns [Array(String)] Generated paths relative to the repository root.
 				# @raises [RuntimeError] If configuration is invalid or an existing generated file differs.
-				def generate(repository:, branch: "main", checks:, approvals: 2, reviewers: nil, signing: File.file?(File.join(@root, "release.cert")), ruby: "3.4")
+				def generate(repository:, branch: "main", checks:, approvals: 2, reviewers: nil, ruby: "3.4")
 					raise "Expected owner/repository." unless repository.match?(/\A[\w.-]+\/[\w.-]+\z/)
 					raise "Unsupported branch name." unless branch.match?(/\A[\w.\/-]+\z/)
 					raise "Select the required CI check names." if checks.empty?
@@ -40,7 +39,6 @@ module Bake
 						"branch" => branch,
 						"checks" => (checks + ["Release validation"]).uniq,
 						"approvals" => approvals,
-						"signing" => signing,
 						"ruby" => ruby,
 						"environment" => "rubygems",
 					}
@@ -145,10 +143,10 @@ module Bake
 				end
 				
 				def render(config)
+					config.delete("signing")
 					self.class.validate_reviewers(config["reviewers"]) if config.key?("reviewers")
 					branch = config.fetch("branch")
 					ruby = config.fetch("ruby")
-					signing = config.fetch("signing")
 					
 					templates = File.expand_path("../../../../templates", __dir__)
 					files = {"config/release.yaml" => YAML.dump(config)}

data/lib/bake/gem/github/trusted_publisher.rb

@@ -0,0 +1,124 @@
+# frozen_string_literal: true
+
+# Released under the MIT License.
+# Copyright, 2026, by Samuel Williams.
+
+require "json"
+require "rubygems/gemcutter_utilities"
+require "rubygems/user_interaction"
+require "uri"
+require_relative "project"
+
+module Bake
+	module Gem
+		module GitHub
+			# Registers the reviewed release workflow with RubyGems.org using its owner API.
+			class TrustedPublisher
+				include ::Gem::UserInteraction
+				include ::Gem::GemcutterUtilities
+				
+				# The RubyGems API scope for managing trusted publishers.
+				SCOPE = :configure_trusted_publishers
+				
+				# The provider type accepted by the RubyGems trusted publisher API.
+				TYPE = "OIDC::TrustedPublisher::GitHubAction"
+				
+				# Load the gem identity and reviewed publisher settings from the current project.
+				# @parameter root [String] The repository root, which must also be the working directory.
+				# @parameter options [Hash] Authentication options passed to {initialize}.
+				# @returns [TrustedPublisher] The configured RubyGems client.
+				def self.load(root, **options)
+					project = Project.new(root)
+					name = Helper.new(root).gemspec.name
+					
+					new(name, project.trusted_publisher, **options)
+				end
+				
+				# Configure an existing gem's expected GitHub Actions publisher.
+				# @parameter name [String] The gem name.
+				# @parameter settings [Hash] Repository owner/name, workflow filename, and environment.
+				# @parameter key [Symbol | Nil] An explicitly selected key in RubyGems credentials.
+				# @parameter otp [String | Nil] An optional MFA code; RubyGems can prompt when required.
+				def initialize(name, settings, key: nil, otp: nil)
+					@path = "api/v1/gems/#{URI.encode_www_form_component(name)}/trusted_publishers"
+					@settings = settings.transform_keys(&:to_s)
+					@options = {key: key, otp: otp}
+					@host = "https://rubygems.org"
+					@api_key = nil
+				end
+				
+				# @attribute [Hash] Options used by RubyGems authentication and MFA support.
+				attr_reader :options
+				
+				# Read the matching publisher without changing publisher configuration.
+				# @returns [Hash] Whether the publisher is configured and its existing API record, if any.
+				# @raises [RuntimeError] If RubyGems cannot list the gem's publishers.
+				def status
+					sign_in(scope: SCOPE) unless api_key
+					publishers = request(:get, expected: "200")
+					raise "Invalid RubyGems trusted publishers response." unless publishers.is_a?(Array)
+					publisher = publishers.find{|record| matching?(record)}
+					
+					return {configured: !publisher.nil?, publisher: publisher}
+				end
+				
+				# Register a missing publisher, preserving all existing publisher registrations.
+				# @returns [Hash] Whether registration was created and the matching API record.
+				# @raises [RuntimeError] If RubyGems rejects registration or returns different settings.
+				def register
+					current = status
+					return {created: false, publisher: current.fetch(:publisher)} if current.fetch(:configured)
+					
+					publisher = request(:post, expected: "201", payload: {trusted_publisher_type: TYPE, trusted_publisher: @settings})
+					raise "RubyGems returned unexpected trusted publisher settings." unless matching?(publisher)
+					
+					return {created: true, publisher: publisher}
+				end
+				
+				# Use the session key or an explicitly supplied credential, leaving the default push key alone.
+				# @returns [String | Nil] The API key used for this session.
+				def api_key
+					@api_key || ENV["GEM_HOST_API_KEY"] || (options[:key] && verify_api_key(options[:key]))
+				end
+				
+				# Keep newly issued credentials in memory rather than changing the user's credentials file.
+				# @parameter host [String] The authenticated RubyGems host.
+				# @parameter key [String] The newly issued API key.
+				def set_api_key(host, key)
+					@api_key = key
+				end
+				
+				private
+				
+				def get_mfa_params(profile)
+					super.merge(expires_at: (Time.now.utc + 900).strftime("%Y-%m-%d %H:%M:%S UTC"))
+				end
+				
+				def matching?(record)
+					return false unless record.fetch("trusted_publisher_type") == TYPE
+					settings = record.fetch("trusted_publisher")
+					
+					# Generated publishing workflows run in the configured repository, not a reusable workflow repository:
+					@settings.all?{|key, value| settings[key] == value} &&
+						settings["workflow_repository_owner"].nil? && settings["workflow_repository_name"].nil?
+				end
+				
+				def request(method, expected:, payload: nil)
+					response = rubygems_api_request(method, @path, scope: SCOPE) do |request|
+						request["Authorization"] = api_key
+						request["Accept"] = "application/json"
+						if payload
+							request["Content-Type"] = "application/json"
+							request.body = JSON.generate(payload)
+						end
+					end
+					unless response.code == expected
+						raise "RubyGems trusted publisher #{method.to_s.upcase} failed (HTTP #{response.code}): #{clean_text(response.body)}"
+					end
+					
+					JSON.parse(response.body)
+				end
+			end
+		end
+	end
+end

data/lib/bake/gem/github/version.rb

@@ -9,7 +9,7 @@ module Bake
 	module Gem
 		# GitHub pull request and release orchestration for bake-gem.
 		module GitHub
-			VERSION = "0.5.0"
+			VERSION = "0.7.0"
 		end
 	end
 end

data/readme.md

@@ -24,6 +24,16 @@ Please see the [project documentation](https://socketry.github.io/bake-gem-githu
 
 Please see the [project releases](https://socketry.github.io/bake-gem-github/releases/index) for all releases.
 
+### v0.7.0
+
+  - Remove RubyGems certificate signing and its private-key requirement. Publishing always builds unsigned gems and verifies Sigstore and GitHub provenance attestations.
+  - Remove the setup `signing` option. Regenerate workflows with `gem:github:setup:update` to remove legacy configuration and signing-secret references.
+
+### v0.6.0
+
+  - Register RubyGems trusted publishers from the gemspec and release configuration with `gem:github:setup:publisher`, reusing existing registrations and RubyGems authentication/MFA support.
+  - Check publisher registration explicitly with `gem:github:setup:plan publisher=true`.
+
 ### v0.5.0
 
   - Support rebase merging by requiring each release PR to contain exactly one commit, while leaving ordinary PRs unrestricted. Generated rules allow merge, squash, and rebase methods according to repository settings.
@@ -62,10 +72,6 @@ Please see the [project releases](https://socketry.github.io/bake-gem-github/rel
   - Preserve verified release files in a draft GitHub release before uploading to RubyGems, so reruns can recover when Actions artifacts disappear.
   - Wait for RubyGems registry propagation before finalizing releases.
 
-### v0.0.1
-
-  - Initial implementation.
-
 ## Contributing
 
 We welcome contributions to this project.

data/releases.md

@@ -1,5 +1,15 @@
 # Releases
 
+## v0.7.0
+
+  - Remove RubyGems certificate signing and its private-key requirement. Publishing always builds unsigned gems and verifies Sigstore and GitHub provenance attestations.
+  - Remove the setup `signing` option. Regenerate workflows with `gem:github:setup:update` to remove legacy configuration and signing-secret references.
+
+## v0.6.0
+
+  - Register RubyGems trusted publishers from the gemspec and release configuration with `gem:github:setup:publisher`, reusing existing registrations and RubyGems authentication/MFA support.
+  - Check publisher registration explicitly with `gem:github:setup:plan publisher=true`.
+
 ## v0.5.0
 
   - Support rebase merging by requiring each release PR to contain exactly one commit, while leaving ordinary PRs unrestricted. Generated rules allow merge, squash, and rebase methods according to repository settings.

data/templates/release-publish.yaml.erb

@@ -68,9 +68,6 @@ jobs:
         id: build
         env:
           GITHUB_TOKEN: ${{ github.token }}
-<% if signing -%>
-          GEM_SIGNING_KEY: ${{ secrets.GEM_SIGNING_KEY }}
-<% end -%>
         run: bundle exec bake gem:github:release:build
       - name: Sign RubyGems attestation
         if: steps.build.outputs.restored != 'true'

metadata

@@ -1,37 +1,12 @@
 --- !ruby/object:Gem::Specification
 name: bake-gem-github
 version: !ruby/object:Gem::Version
-  version: 0.5.0
+  version: 0.7.0
 platform: ruby
 authors:
 - Samuel Williams
 bindir: bin
-cert_chain:
-- |
-  -----BEGIN CERTIFICATE-----
-  MIIEFDCCAnygAwIBAgIBATANBgkqhkiG9w0BAQsFADAwMREwDwYDVQQKDAhTb2Nr
-  ZXRyeTEbMBkGA1UEAwwSU29ja2V0cnkgUnVieSBHZW1zMB4XDTI2MDkyMTA3NTgx
-  NFoXDTI3MDkyMTA3NTgxNFowMDERMA8GA1UECgwIU29ja2V0cnkxGzAZBgNVBAMM
-  ElNvY2tldHJ5IFJ1YnkgR2VtczCCAaIwDQYJKoZIhvcNAQEBBQADggGPADCCAYoC
-  ggGBAM/QgjVgDzDo/xJEQoFvAzcVFP7msnswkhPJB2UDsbxXCZmers5jV512TM5s
-  NwLHfzJiC4DcI5ax9ZYKM9Q+dS21YYagNqjtg3YPyDqR6phoibEA0VoMuInUQW68
-  i5OkCJzYKGD2pYYVZnuFNqyM2ECUvXh/fBmvPoHbncAHhWPaCBH8mQJ8sRNc6+RV
-  SoZZu1Yo/aW1zQ+SpZwad7s1ZmigfDNHKhJ22KwZHk+/5Zw1QXVfcajjswV0Mm2P
-  irgjKN3fyNVkwlly63EBlR4VydT+g9QtJtqh7ee0ThhI+v4wYovf4dbLNcEBTHu1
-  x1pGbXGx/2fBAST5eVwaXIx1V8VU22AJcBk1H2o5/1F0HfbD2HQjmFOA112KUwBW
-  9TtspZD3g6rCQFX53XvL9h6j2y1ukl7s5AdEzOe/x6r1MO8tSDtgcYoF89wgF/88
-  Q/Eski0FckQ+znfESZcFcpzs2sPDoYW6SNVX4tZcNty85Y6WBHfHKio14x63PeyC
-  CG1gMwIDAQABozkwNzAJBgNVHRMEAjAAMAsGA1UdDwQEAwIEsDAdBgNVHQ4EFgQU
-  SuMc0x24Xshtaa8SQVkBr2Z5WzIwDQYJKoZIhvcNAQELBQADggGBABI62ey5lDWm
-  j8jsTQaNBMBb7LbKS3XkBwyL1UNGEwlicp399rJDeuNgVSHqBCZ/nE4yleNjgW9Y
-  N6DKdxXCvXmFUoHvUINeAvThHxmlEGhSfXl1x55xHEig0rEP4jgdjnYdQI4fqeOM
-  zIDN0F3ruArke4Y62SQgWVN7vspdAA41hBIRl1vsvs0KWG8DIVQ8cmR+TG6zjOmK
-  iUiUZGNPnStV1O1xW83c+Ba4Am0krP6/forxDPhRvTehqkVYvMdPfYcICNb5IM58
-  5vaYvuj5AtfZuZWN0F/0KtSphhNC17rh6h8QmuYdMJ1clvlrkiEaO1UjPVwjgtxC
-  x/ARh5X6q0/YTXl4r7EfSJEeqW7qhgu9EUj3mGIPHYdX0Dqih/NgK20F3GvQtTfB
-  7sse0duKBHXONYVwKAsceUVvqtCfyF608bCilCkbhw3QaInRj+BkRQKJ5Tuj2PZR
-  76a/hwaV2wWn5RtAFBaUQzQdo/xTqJ7IkwaFjOZe/QyvyoRjCK9Rdg==
-  -----END CERTIFICATE-----
+cert_chain: []
 date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
@@ -107,10 +82,10 @@ files:
 - lib/bake/gem/github/publisher.rb
 - lib/bake/gem/github/registry.rb
 - lib/bake/gem/github/setup.rb
+- lib/bake/gem/github/trusted_publisher.rb
 - lib/bake/gem/github/version.rb
 - license.md
 - readme.md
-- release.cert
 - releases.md
 - templates/release-prepare.yaml.erb
 - templates/release-publish.yaml.erb

checksums.yaml.gz.sig

@@ -1 +0,0 @@
-�?f�h�

data/release.cert

@@ -1,24 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIEFDCCAnygAwIBAgIBATANBgkqhkiG9w0BAQsFADAwMREwDwYDVQQKDAhTb2Nr
-ZXRyeTEbMBkGA1UEAwwSU29ja2V0cnkgUnVieSBHZW1zMB4XDTI2MDkyMTA3NTgx
-NFoXDTI3MDkyMTA3NTgxNFowMDERMA8GA1UECgwIU29ja2V0cnkxGzAZBgNVBAMM
-ElNvY2tldHJ5IFJ1YnkgR2VtczCCAaIwDQYJKoZIhvcNAQEBBQADggGPADCCAYoC
-ggGBAM/QgjVgDzDo/xJEQoFvAzcVFP7msnswkhPJB2UDsbxXCZmers5jV512TM5s
-NwLHfzJiC4DcI5ax9ZYKM9Q+dS21YYagNqjtg3YPyDqR6phoibEA0VoMuInUQW68
-i5OkCJzYKGD2pYYVZnuFNqyM2ECUvXh/fBmvPoHbncAHhWPaCBH8mQJ8sRNc6+RV
-SoZZu1Yo/aW1zQ+SpZwad7s1ZmigfDNHKhJ22KwZHk+/5Zw1QXVfcajjswV0Mm2P
-irgjKN3fyNVkwlly63EBlR4VydT+g9QtJtqh7ee0ThhI+v4wYovf4dbLNcEBTHu1
-x1pGbXGx/2fBAST5eVwaXIx1V8VU22AJcBk1H2o5/1F0HfbD2HQjmFOA112KUwBW
-9TtspZD3g6rCQFX53XvL9h6j2y1ukl7s5AdEzOe/x6r1MO8tSDtgcYoF89wgF/88
-Q/Eski0FckQ+znfESZcFcpzs2sPDoYW6SNVX4tZcNty85Y6WBHfHKio14x63PeyC
-CG1gMwIDAQABozkwNzAJBgNVHRMEAjAAMAsGA1UdDwQEAwIEsDAdBgNVHQ4EFgQU
-SuMc0x24Xshtaa8SQVkBr2Z5WzIwDQYJKoZIhvcNAQELBQADggGBABI62ey5lDWm
-j8jsTQaNBMBb7LbKS3XkBwyL1UNGEwlicp399rJDeuNgVSHqBCZ/nE4yleNjgW9Y
-N6DKdxXCvXmFUoHvUINeAvThHxmlEGhSfXl1x55xHEig0rEP4jgdjnYdQI4fqeOM
-zIDN0F3ruArke4Y62SQgWVN7vspdAA41hBIRl1vsvs0KWG8DIVQ8cmR+TG6zjOmK
-iUiUZGNPnStV1O1xW83c+Ba4Am0krP6/forxDPhRvTehqkVYvMdPfYcICNb5IM58
-5vaYvuj5AtfZuZWN0F/0KtSphhNC17rh6h8QmuYdMJ1clvlrkiEaO1UjPVwjgtxC
-x/ARh5X6q0/YTXl4r7EfSJEeqW7qhgu9EUj3mGIPHYdX0Dqih/NgK20F3GvQtTfB
-7sse0duKBHXONYVwKAsceUVvqtCfyF608bCilCkbhw3QaInRj+BkRQKJ5Tuj2PZR
-76a/hwaV2wWn5RtAFBaUQzQdo/xTqJ7IkwaFjOZe/QyvyoRjCK9Rdg==
------END CERTIFICATE-----

metadata.gz.sig

@@ -1 +0,0 @@
-���y0�a�tq��ok��̤�ebَk��z�3�
!�:ւ/�đ�U����кq�-�e���V��<ӽ�0["�	n���xϼ�ڄd�eS_��;��J��1#����4 D��w�0��P�t܁G)!�����ș?Ǔ[䱭&�^O@���wƁ}E�x��x����F�#U3w�.D2��ϒ\�,m����O��pV�u�!&�M]�Z��4�}jv���s2����W�=I���~�|�RhE��5��LK����l^v���3ӏ�:�,&z-��M
Ns�7���4�	�X�թ��Fbrjst6P�����b�"���֝�S�D��h��I�@����+P�ߗ�