gem-contribute 0.3.0 → 0.3.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/.github/workflows/release.yml +71 -0
- data/CHANGELOG.md +12 -0
- data/MAINTAINER.md +119 -2
- data/docs/ROADMAP.md +1 -1
- data/lib/gem_contribute/version.rb +1 -1
- metadata +7 -3
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: 642744289b8e25b5109868d7ef71fbb33e7067d79d8fb9c6580e8a88b566dea6
|
|
4
|
+
data.tar.gz: d2e5cca3a504bd75de537e9b38ba22a0ff2f2b6915162cb9d37f5d065933cc72
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: a2600e3b0ee2adf44fcadab52639e446aae0d15f7d4843c111d68d86b3fd726bed20d72ad62063c72230656cdf8c62a52d7fc1507b7e5fb85032678f77ae99a7
|
|
7
|
+
data.tar.gz: 1f208fe93824d839c8ca78cf842a5cc0fcbebcf3c9b4f89cf8d9fcdd1c403ce19b9b1f0c1e664b1a3b5d681e45f80559e8c333d3ba752111e64726b633491ed9
|
|
@@ -0,0 +1,71 @@
|
|
|
1
|
+
name: Release
|
|
2
|
+
|
|
3
|
+
# Triggers on `v*` tag pushes (e.g. `v0.4.0`). Verifies the tag matches
|
|
4
|
+
# `GemContribute::VERSION` and that CHANGELOG.md has a dated section for
|
|
5
|
+
# it, then runs rubocop + rspec as a final gate and publishes to
|
|
6
|
+
# rubygems.org via Trusted Publishing (OIDC). No `RUBYGEMS_API_KEY`
|
|
7
|
+
# secret — the rubygems.org-side trusted-publisher entry mints a
|
|
8
|
+
# short-lived token from the GitHub Actions OIDC claim. Compatible with
|
|
9
|
+
# `rubygems_mfa_required = true`, which the gemspec already sets.
|
|
10
|
+
#
|
|
11
|
+
# First-run setup (one-time, before the first tag push): see
|
|
12
|
+
# MAINTAINER.md → "Cutting a release". The rubygems.org Trusted
|
|
13
|
+
# Publisher entry must exist before this workflow can succeed.
|
|
14
|
+
#
|
|
15
|
+
# The `release` environment scopes the OIDC claim — only workflow runs
|
|
16
|
+
# in that environment can authenticate to rubygems.org. Configure it at
|
|
17
|
+
# Settings → Environments in the GitHub repo (no secrets, no protection
|
|
18
|
+
# rules required, but adding a "required reviewer" gives a manual
|
|
19
|
+
# approval gate before publishes).
|
|
20
|
+
|
|
21
|
+
on:
|
|
22
|
+
push:
|
|
23
|
+
tags:
|
|
24
|
+
- 'v*'
|
|
25
|
+
|
|
26
|
+
permissions:
|
|
27
|
+
contents: write # create the GitHub release with auto-generated notes
|
|
28
|
+
id-token: write # request OIDC token for Trusted Publishing
|
|
29
|
+
|
|
30
|
+
jobs:
|
|
31
|
+
release:
|
|
32
|
+
name: Build, test, and publish
|
|
33
|
+
runs-on: ubuntu-latest
|
|
34
|
+
environment: release
|
|
35
|
+
steps:
|
|
36
|
+
- uses: actions/checkout@v4
|
|
37
|
+
|
|
38
|
+
- name: Set up Ruby
|
|
39
|
+
uses: ruby/setup-ruby@v1
|
|
40
|
+
with:
|
|
41
|
+
ruby-version: "3.2"
|
|
42
|
+
bundler-cache: true
|
|
43
|
+
|
|
44
|
+
- name: Verify tag matches gemspec version and CHANGELOG section
|
|
45
|
+
env:
|
|
46
|
+
REF_NAME: ${{ github.ref_name }}
|
|
47
|
+
run: |
|
|
48
|
+
set -euo pipefail
|
|
49
|
+
tag_version="${REF_NAME#v}"
|
|
50
|
+
gem_version=$(ruby -r./lib/gem_contribute/version -e 'print GemContribute::VERSION')
|
|
51
|
+
|
|
52
|
+
if [ "$tag_version" != "$gem_version" ]; then
|
|
53
|
+
echo "::error::Tag $REF_NAME does not match GemContribute::VERSION ($gem_version)."
|
|
54
|
+
echo "Bump lib/gem_contribute/version.rb or retag, then push."
|
|
55
|
+
exit 1
|
|
56
|
+
fi
|
|
57
|
+
|
|
58
|
+
if ! grep -Fq "## [$gem_version]" CHANGELOG.md; then
|
|
59
|
+
echo "::error::CHANGELOG.md is missing a '## [$gem_version]' section."
|
|
60
|
+
echo "Add a dated section before tagging — see existing entries for the shape."
|
|
61
|
+
exit 1
|
|
62
|
+
fi
|
|
63
|
+
|
|
64
|
+
- name: rubocop
|
|
65
|
+
run: bin/rubocop
|
|
66
|
+
|
|
67
|
+
- name: rspec
|
|
68
|
+
run: bin/rspec
|
|
69
|
+
|
|
70
|
+
- name: Publish to rubygems.org via Trusted Publishing
|
|
71
|
+
uses: rubygems/release-gem@v1
|
data/CHANGELOG.md
CHANGED
|
@@ -4,6 +4,18 @@ All notable changes to this project will be documented here. The format is based
|
|
|
4
4
|
|
|
5
5
|
## [Unreleased]
|
|
6
6
|
|
|
7
|
+
## [0.3.1] - 2026-05-04
|
|
8
|
+
|
|
9
|
+
### Added
|
|
10
|
+
|
|
11
|
+
- Release workflow (`.github/workflows/release.yml`) — `v*` tag push triggers a publish to rubygems.org via [Trusted Publishing](https://guides.rubygems.org/trusted-publishing/) (OIDC). No `RUBYGEMS_API_KEY` secret involved; rubygems.org issues a short-lived token from the GitHub Actions OIDC claim. The workflow verifies the tag matches `GemContribute::VERSION` and that `CHANGELOG.md` has a dated section for it before running rubocop, rspec, and the publish step. First-time setup (rubygems.org pending-trusted-publisher entry, `release` GitHub Environment) is documented in `MAINTAINER.md` (closes [#44](https://github.com/cdhagmann/gem-contribute/issues/44)).
|
|
12
|
+
|
|
13
|
+
### Fixed
|
|
14
|
+
|
|
15
|
+
- `Gemfile.lock` regenerated to match `GemContribute::VERSION` after the 0.3.0 bump (commit `077eadb`) updated `version.rb` without running `bundle install`. CI runs bundler in deployment mode and was failing on the lockfile/gemspec mismatch. The MAINTAINER.md per-release checklist now calls out `bundle install` as an explicit step so the next bump doesn't repeat this.
|
|
16
|
+
|
|
17
|
+
## [0.3.0] - 2026-05-04
|
|
18
|
+
|
|
7
19
|
### Added
|
|
8
20
|
|
|
9
21
|
- `gem-contribute fork <gem>` — the look-around-first counterpart to `fix`: fork the gem's repo, clone it, leave you on the default branch with no issue-tied work yet. Same `-e` / `-a` flags. Use this when you want to read the code before deciding whether to commit to a specific issue (closes [#12](https://github.com/cdhagmann/gem-contribute/issues/12)).
|
data/MAINTAINER.md
CHANGED
|
@@ -86,7 +86,124 @@ older gem versions continue to work.
|
|
|
86
86
|
|
|
87
87
|
## Cutting a release
|
|
88
88
|
|
|
89
|
-
|
|
90
|
-
|
|
89
|
+
Releases publish to rubygems.org via [Trusted Publishing][gh-trusted-pub]
|
|
90
|
+
(OIDC) — there is no `RUBYGEMS_API_KEY` secret and no manual `gem push`.
|
|
91
|
+
A `v*` tag push triggers `.github/workflows/release.yml`, which verifies
|
|
92
|
+
the tag matches `GemContribute::VERSION`, checks that `CHANGELOG.md` has a
|
|
93
|
+
dated section for the version, runs rubocop and rspec, and then publishes.
|
|
94
|
+
|
|
95
|
+
### One-time setup (before the first automated release)
|
|
96
|
+
|
|
97
|
+
The rubygems.org Trusted Publisher entry must exist before any tag push
|
|
98
|
+
can succeed. For an unclaimed gem name, use the **pending publisher**
|
|
99
|
+
flow:
|
|
100
|
+
|
|
101
|
+
1. Sign in at <https://rubygems.org>.
|
|
102
|
+
|
|
103
|
+
2. Go to <https://rubygems.org/profile/me/oidc/pending_trusted_publishers/new>.
|
|
104
|
+
|
|
105
|
+
3. Fill in the form:
|
|
106
|
+
|
|
107
|
+
| Field | Value |
|
|
108
|
+
|-------------------|----------------------|
|
|
109
|
+
| Gem name | `gem-contribute` |
|
|
110
|
+
| Repository owner | `cdhagmann` |
|
|
111
|
+
| Repository name | `gem-contribute` |
|
|
112
|
+
| Workflow filename | `release.yml` |
|
|
113
|
+
| Environment | `release` |
|
|
114
|
+
|
|
115
|
+
The "Environment" value matches `environment: release` in the
|
|
116
|
+
workflow. Leave blank if you removed that line; otherwise both must
|
|
117
|
+
match exactly.
|
|
118
|
+
|
|
119
|
+
4. Submit. The publisher entry is now "pending" — it has no gem attached
|
|
120
|
+
yet. The first successful publish from this workflow claims the name
|
|
121
|
+
and promotes the entry to a regular trusted publisher.
|
|
122
|
+
|
|
123
|
+
After the gem is published, you can add additional trusted publishers
|
|
124
|
+
(e.g. for a fork or replacement workflow) from the gem's settings page on
|
|
125
|
+
rubygems.org instead of the pending-publisher flow.
|
|
126
|
+
|
|
127
|
+
### Configure the GitHub environment (one-time)
|
|
128
|
+
|
|
129
|
+
The workflow runs in an `environment: release` job. Create the environment
|
|
130
|
+
in the repo so the OIDC claim carries the correct value:
|
|
131
|
+
|
|
132
|
+
1. GitHub repo → Settings → Environments → **New environment**.
|
|
133
|
+
2. Name it `release`.
|
|
134
|
+
3. (Optional) Add yourself as a **Required reviewer** for a manual
|
|
135
|
+
approval gate before each publish. Recommended for the first few
|
|
136
|
+
releases until you trust the workflow.
|
|
137
|
+
4. No secrets to configure. Trusted publishing replaces secrets entirely.
|
|
138
|
+
|
|
139
|
+
### Per-release checklist
|
|
140
|
+
|
|
141
|
+
When cutting a new version:
|
|
142
|
+
|
|
143
|
+
1. **Bump the version.** Edit `lib/gem_contribute/version.rb` to the new
|
|
144
|
+
`MAJOR.MINOR.PATCH`. Follow [SemVer](https://semver.org/).
|
|
145
|
+
|
|
146
|
+
2. **Regenerate `Gemfile.lock`.** Run `bundle install`. The lockfile's
|
|
147
|
+
`gem-contribute (X.Y.Z)` line must match the new version in both the
|
|
148
|
+
PATH spec at the top and the CHECKSUMS section near the bottom. CI
|
|
149
|
+
runs bundler in deployment/`--frozen` mode and refuses to install if
|
|
150
|
+
the lockfile is out of sync with the gemspec.
|
|
151
|
+
|
|
152
|
+
3. **Update CHANGELOG.md.** Move the contents of `[Unreleased]` into a
|
|
153
|
+
new dated section: `## [X.Y.Z] - YYYY-MM-DD`. Leave `[Unreleased]`
|
|
154
|
+
empty for the next cycle. The release workflow refuses to publish if
|
|
155
|
+
it can't find a `## [X.Y.Z]` section matching the tag.
|
|
156
|
+
|
|
157
|
+
4. **Commit on `main`.** Bump version.rb, the regenerated Gemfile.lock,
|
|
158
|
+
and CHANGELOG.md all in the same commit. Conventional message:
|
|
159
|
+
`Bump gem-contribute to X.Y.Z`.
|
|
160
|
+
|
|
161
|
+
5. **Tag and push.**
|
|
162
|
+
|
|
163
|
+
```sh
|
|
164
|
+
git tag -a vX.Y.Z -m "X.Y.Z"
|
|
165
|
+
git push origin main vX.Y.Z
|
|
166
|
+
```
|
|
167
|
+
|
|
168
|
+
6. **Watch the Actions tab.** The workflow will:
|
|
169
|
+
- verify the tag/version/CHANGELOG match
|
|
170
|
+
- run rubocop and rspec
|
|
171
|
+
- request an OIDC token, exchange it for a short-lived rubygems API
|
|
172
|
+
key, and publish the gem
|
|
173
|
+
- create a draft GitHub release with auto-generated notes
|
|
174
|
+
|
|
175
|
+
If the environment has a required-reviewer protection rule, the
|
|
176
|
+
workflow will pause for your manual approval before the publish step.
|
|
177
|
+
|
|
178
|
+
7. **Sanity check.** After publish, `gem info gem-contribute` should show
|
|
179
|
+
the new version. The draft GitHub release is yours to edit and publish
|
|
180
|
+
when ready.
|
|
181
|
+
|
|
182
|
+
### Troubleshooting
|
|
183
|
+
|
|
184
|
+
- **"Tag … does not match GemContribute::VERSION"** — version.rb is out of
|
|
185
|
+
sync with the tag. Either delete the tag and bump version.rb, or
|
|
186
|
+
re-tag at the right SHA after fixing version.rb.
|
|
187
|
+
- **"CHANGELOG.md is missing a section for …"** — add the dated section,
|
|
188
|
+
amend the bump commit, force-push, delete the old tag, retag, push.
|
|
189
|
+
(Force-push is fine on the bump commit before the publish has
|
|
190
|
+
succeeded.)
|
|
191
|
+
- **OIDC failure / "no trusted publisher matches"** — check the
|
|
192
|
+
rubygems.org publisher entry: gem name, repo owner, repo name,
|
|
193
|
+
workflow filename (`release.yml`, not the full path), and environment
|
|
194
|
+
must all match. The workflow filename is the basename only, no
|
|
195
|
+
`.github/workflows/` prefix.
|
|
196
|
+
- **`gem push` fails with `multifactor authentication required`** —
|
|
197
|
+
trusted publishing satisfies MFA. If you see this error, the workflow
|
|
198
|
+
fell back to a non-OIDC path; verify `permissions.id-token: write` is
|
|
199
|
+
set on the job.
|
|
200
|
+
|
|
201
|
+
### Yanking a release
|
|
202
|
+
|
|
203
|
+
Yanks happen via the rubygems.org web UI or `gem yank gem-contribute -v
|
|
204
|
+
X.Y.Z`. There is no automated yank flow — by design. If you need to yank,
|
|
205
|
+
also delete the corresponding `vX.Y.Z` tag and GitHub release so the
|
|
206
|
+
record on GitHub matches what's available on rubygems.org.
|
|
91
207
|
|
|
92
208
|
[gh-device-flow]: https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps#device-flow
|
|
209
|
+
[gh-trusted-pub]: https://guides.rubygems.org/trusted-publishing/
|
data/docs/ROADMAP.md
CHANGED
|
@@ -213,7 +213,7 @@ Everything required to call it 1.0 and not 0.x.
|
|
|
213
213
|
- [ ] [#42](https://github.com/cdhagmann/gem-contribute/issues/42) — Add MAINTAINER.md (release process, OAuth App, plugin verification)
|
|
214
214
|
- [ ] OAuth App: stay on personal-account App for v1.0 (per Q13); migrate when rate limits bite
|
|
215
215
|
- [ ] [#43](https://github.com/cdhagmann/gem-contribute/issues/43) — CI workflow (`.github/workflows/ci.yml`): rubocop + rspec; gated integration tests; plugin install smoke (basic rubocop + rspec already landed via [PR #21](https://github.com/cdhagmann/gem-contribute/pull/21) / [#7](https://github.com/cdhagmann/gem-contribute/issues/7); gated integration tests and plugin smoke still pending)
|
|
216
|
-
- [
|
|
216
|
+
- [x] [#44](https://github.com/cdhagmann/gem-contribute/issues/44) — Release workflow (`.github/workflows/release.yml`) with **Trusted Publishing (OIDC)** (will go live with the 0.4 release)
|
|
217
217
|
- [ ] 🌱 [#45](https://github.com/cdhagmann/gem-contribute/issues/45) — Archive workshop docs to `docs/archive/`
|
|
218
218
|
- [ ] [#46](https://github.com/cdhagmann/gem-contribute/issues/46) — README rewrite for v1 audience
|
|
219
219
|
- [ ] Verify `bundle plugin install` and `gem install` from a clean machine (covered by CI smoke test in #43)
|
metadata
CHANGED
|
@@ -1,13 +1,14 @@
|
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
|
2
2
|
name: gem-contribute
|
|
3
3
|
version: !ruby/object:Gem::Version
|
|
4
|
-
version: 0.3.
|
|
4
|
+
version: 0.3.1
|
|
5
5
|
platform: ruby
|
|
6
6
|
authors:
|
|
7
7
|
- Chris Hagmann
|
|
8
|
+
autorequire:
|
|
8
9
|
bindir: exe
|
|
9
10
|
cert_chain: []
|
|
10
|
-
date:
|
|
11
|
+
date: 2026-05-04 00:00:00.000000000 Z
|
|
11
12
|
dependencies:
|
|
12
13
|
- !ruby/object:Gem::Dependency
|
|
13
14
|
name: bundler
|
|
@@ -126,6 +127,7 @@ files:
|
|
|
126
127
|
- ".github/workflows/auto-merge-kicked-tires.yml"
|
|
127
128
|
- ".github/workflows/ci.yml"
|
|
128
129
|
- ".github/workflows/pr-template-check.yml"
|
|
130
|
+
- ".github/workflows/release.yml"
|
|
129
131
|
- CHANGELOG.md
|
|
130
132
|
- CLAUDE.md
|
|
131
133
|
- CODE_OF_CONDUCT.md
|
|
@@ -211,6 +213,7 @@ metadata:
|
|
|
211
213
|
changelog_uri: https://github.com/cdhagmann/gem-contribute/blob/main/CHANGELOG.md
|
|
212
214
|
documentation_uri: https://cdhagmann.com/gem-contribute/
|
|
213
215
|
rubygems_mfa_required: 'true'
|
|
216
|
+
post_install_message:
|
|
214
217
|
rdoc_options: []
|
|
215
218
|
require_paths:
|
|
216
219
|
- lib
|
|
@@ -225,7 +228,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
|
|
|
225
228
|
- !ruby/object:Gem::Version
|
|
226
229
|
version: '0'
|
|
227
230
|
requirements: []
|
|
228
|
-
rubygems_version: 4.
|
|
231
|
+
rubygems_version: 3.4.19
|
|
232
|
+
signing_key:
|
|
229
233
|
specification_version: 4
|
|
230
234
|
summary: Find and contribute to the open-source Ruby gems your project depends on.
|
|
231
235
|
test_files: []
|