http_connection_pool 0.1.0 → 0.1.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: dcde2d73c540f08460cedccdbe23d1b963a6efadb10572932b33c27ba7e2ad24
-  data.tar.gz: 01e68de6a8cff18d5aa24479a78342016fbf11d424a21a612e28158114a7ebbc
+  metadata.gz: 7eda7bcf22d08a247318605caf1b01ced7de85553cbc5f8fa26bce19645281c5
+  data.tar.gz: 393a2e5f62a4ccb668321deb9678a58c2a34f683b93a13edd76a7378bd6eb2c7
 SHA512:
-  metadata.gz: 56d902f8c8cec43e09a689c934f7f6c2632db1066f107abbfebc7c85fa1b114f6f83c5ec3e3c83bf15444377b68fa24c7bb8874211328237ca579d0360e7b22a
-  data.tar.gz: 1d134c8c37cec6111439e1761dcd6e9e88efccdb138805ce37c906ba8b19492b12e41547b5f58d705724f25ca2fcb8e02ddb417f35e44f1db17d148ebae03b56
+  metadata.gz: a2a5d74ba19a9ccdf798bd04dd55dfcc29f0d2006f0d8b91c71eeb7ddf3e3445eef18864f83e3d88ad6fa8a6645148bd3dce3989fe5def2af9ec351ea4edd058
+  data.tar.gz: 9605d8e616846ebfbea278318b1be8821ca1341cc78042e044a9c7889d13f6f238ae79e295c192e3e7708a23ad746dd463cd85a5b0d95f3f41202647455a59ed

data/README.md

@@ -1,5 +1,7 @@
 # HttpConnectionPool
 
+[![CI](https://github.com/bbarberBPL/http_connection_pool/actions/workflows/ci.yml/badge.svg)](https://github.com/bbarberBPL/http_connection_pool/actions/workflows/ci.yml)
+
 Thread-safe (and Fiber-scheduler-aware) persistent HTTP connection pooling for
 the [http.rb](https://github.com/httprb/http) gem.
 
@@ -477,13 +479,45 @@ bundle exec rake build:checksum   # build, then write SHA-256 + SHA-512 to check
 ```
 
 `rake build:checksum` records both digests under `checksums/` in the standard
-`sha256sum -c` / `sha512sum -c` format, so a published artifact can be verified
-against this repository. The built `.gem` is never committed; only its
-checksums are.
+`sha256sum -c` / `sha512sum -c` format. Neither the built `.gem` nor its
+checksums are committed (both directories are gitignored); the release workflow
+runs `build:checksum` against the exact gem it just published and attaches the
+digests to the GitHub Release, so the published artifact is what gets verified.
+
+#### Releasing
+
+Releases are cut by bumping the version locally and pushing a matching tag; a
+GitHub Actions workflow then tests and publishes to RubyGems over OIDC (no API
+key is stored anywhere). The maintainer pushes the tag — the workflow runs the
+`gem push`.
+
+```bash
+bundle exec rake bump:patch   # 0.1.0 -> 0.1.1; rewrites version.rb
+git add lib/http_connection_pool/version.rb
+git commit -m 'Release v0.1.1'
+git tag v0.1.1
+git push && git push --tags   # the tag push triggers the release workflow
+```
 
-Publishing to RubyGems is a manual, maintainer-only step — this project
-deliberately ships no automated push task. Regenerate the checksums whenever
-the version changes, immediately before publishing.
+Use `bump:minor` or `bump:major` for those components. On the `v*.*.*` tag,
+`.github/workflows/release.yml` verifies the tag matches
+`HttpConnectionPool::VERSION`, re-runs the specs, publishes via
+`rubygems/release-gem` (which builds and `gem push`es over OIDC), then records
+SHA-256/SHA-512 digests of the published gem and creates a GitHub Release with
+the gem and checksum files attached.
+
+**One-time setup (maintainer, on rubygems.org):** register this repository as a
+Trusted Publisher before the first release. On rubygems.org, add a GitHub
+Actions trusted publisher for repository `bbarberBPL/http_connection_pool` and
+workflow `release.yml` (for the not-yet-published gem, add it as a *pending*
+trusted publisher under your profile's OIDC settings; afterwards it lives on the
+gem's *Trusted Publishers* page). Until this exists, the publish step fails.
+
+The gem sets `rubygems_mfa_required`, so all privileged interactive operations
+(yank, ownership, manual pushes, API-key management) require your authenticator
+app. OIDC Trusted Publishing satisfies this MFA requirement for automated
+releases — the verified GitHub Actions identity is the second factor — so no
+one-time-password prompt appears in CI.
 
 ## License
 

data/lib/http_connection_pool/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module HttpConnectionPool
-  VERSION = '0.1.0'
+  VERSION = '0.1.1'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: http_connection_pool
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.1.1
 platform: ruby
 authors:
 - bbarberBPL
@@ -77,9 +77,13 @@ files:
 - lib/http_connection_pool/pool.rb
 - lib/http_connection_pool/registry.rb
 - lib/http_connection_pool/version.rb
+homepage: https://rubygems.org/gems/http_connection_pool
 licenses:
 - MIT
-metadata: {}
+metadata:
+  homepage_uri: https://rubygems.org/gems/http_connection_pool
+  source_code_uri: https://github.com/bbarberBPL/http_connection_pool
+  rubygems_mfa_required: 'true'
 rdoc_options: []
 require_paths:
 - lib
@@ -94,7 +98,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.14
+rubygems_version: 3.6.9
 specification_version: 4
 summary: Thread-safe persistent HTTP connection pool for the http.rb gem
 test_files: []