logtail 0.1.18 → 0.1.19

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 93f4739daeaac5fe30db5251e9463e4139adcb9fe1bb5cc06988bd2617827d1c
-  data.tar.gz: 7de7ff6b0b83de585e95c70c2fea5ce2e2c7067592d6f18f8d139db665525c75
+  metadata.gz: cd895e734e1d553b0dfdf1011f0a46b6f043a50c391d27822ee015a517759650
+  data.tar.gz: 964ab22275d822db5df10f3a4616e25d500b0d9292057ea26f4467be40786e63
 SHA512:
-  metadata.gz: 80fe56d644e5f07108859de6399c29f16fd26b7294b5ea63bc8b710b4ad9de757048e61c89e3e27837643c61d63525c79c60d9384c338c410daf8dacc840cac4
-  data.tar.gz: 64b96d54f5531470e8b87cb0e2ba4515266b25a5c03c20828cc3d1fb8e21ac81dc686057ac4b927b5bb55f571ef7c1f1b0e22265eaf342e5302d746d00ff0222
+  metadata.gz: 6556a1a6135a0c12070fab2080f43800e48fc0c7acfebab062d70ccc99999dadcbcb913145312d3fd61a0a5ad9f3ab411e6017a2cfe5cb55988867f882a748ec
+  data.tar.gz: 10e8559ff2347820d3e7d0af52c019fbdd84c82507653f232b33e1bfdd9cd35382ba04a109537e6c537b429df857e0383bd2b3930cd60f576d121fb1e1f0f5ab

data/.github/workflows/release.yml

@@ -1,10 +1,11 @@
-# Publishes the gem to RubyGems.org from GitHub Actions, the way logtail-js and logtail-python
-# release their packages. The publish job runs in the "rubygems" environment, which only deploys
-# from main; anyone who can dispatch the workflow can release.
+# Publishes the gem to RubyGems.org from GitHub Actions with trusted publishing (OIDC), the way
+# logtail-js releases the @logtail/* packages to npm. No RubyGems.org API key exists anywhere:
+# the gem on rubygems.org trusts exactly this workflow file, run from this repository in the
+# "rubygems" environment, and the shared account's multi-factor authentication stays as it is.
 #
-# Authentication: the repository secret RUBYGEMS_CREDENTIALS holds the contents of a gem
-# credentials file for the shared rubygems.org account, i.e. ":rubygems_api_key: rubygems_…",
-# the line the manual process kept in ~/.local/share/gem/credentials.
+# One-time setup on rubygems.org, signed in as the gem's owner: the gem's page → Trusted publishers
+# → GitHub Actions, with the repository owner "logtail", this repository's name, the workflow
+# "release.yml" and the environment "rubygems".
 #
 # Repository settings this relies on: the "rubygems" environment with deployment branches limited
 # to main and no required reviewers (add reviewers there if releases should need an approval; a
@@ -17,15 +18,17 @@
 # both, pushes the gem to RubyGems.org and creates a GitHub release with auto-generated notes for
 # the tag; edit the notes afterwards if needed.
 #
-# Retry: if a release failed after the version commit was pushed, run "retry" right away from
-# main. It bumps nothing, rebuilds the tagged commit, pushes the gem if RubyGems.org is still
-# missing it and creates the GitHub release if it is still missing. Running patch or minor again
-# would release the next version instead.
+# Retry: if a release failed after the version commit was pushed, run "retry" from main. It bumps
+# nothing, checks out the tag of the version in lib/*/version.rb and rebuilds that commit, pushes
+# the gem if RubyGems.org is still missing it and creates the GitHub release if it is still
+# missing. Running patch or minor again would release the next version instead.
 #
-# Dry run: bumps in place without committing, builds the gem and checks the credentials secret,
-# publishes nothing. Every push that touches this file is a dry run, so a change to the workflow
-# proves itself on its pull request before it reaches main. A dry run can also be dispatched from
-# any branch.
+# Dry run: bumps in place without committing, builds the gem and, on main, exchanges the
+# workflow's OIDC token with RubyGems.org, which proves that the trusted publisher matches this
+# workflow. Nothing is pushed. Every push that touches this file is a dry run, so a change to the
+# workflow proves itself on its pull request before it reaches main, and the push that merges it
+# performs the token exchange as well, because the "rubygems" environment only admits main. A dry
+# run can also be dispatched from any branch.
 name: Release
 
 on:
@@ -37,7 +40,7 @@ on:
         options: [patch, minor, retry]
         required: true
       dry_run:
-        description: "Dry run: bump and build, check the credentials, publish nothing"
+        description: "Dry run: bump and build, verify RubyGems.org accepts this workflow, publish nothing"
         type: boolean
         default: false
   push:
@@ -108,7 +111,9 @@ jobs:
           tagged = `git tag --points-at HEAD`.split.include?("v#{current}")
 
           if release == "retry"
-            abort("retry only finishes a release whose version commit v#{current} is HEAD") unless tagged
+            # main may have moved on since the version commit, so build what the tag points at
+            abort("retry only finishes a release whose version v#{current} is tagged") unless system("git", "rev-parse", "-q", "--verify", "refs/tags/v#{current}", out: File::NULL)
+            system("git", "checkout", "-q", "v#{current}") || abort("could not check out v#{current}")
             version = current
           else
             abort("HEAD is already released as v#{current}, there is nothing new to release") if tagged && !dry_run
@@ -126,6 +131,7 @@ jobs:
         env:
           VERSION: ${{ steps.version.outputs.version }}
         run: |
+          git diff --stat
           gem build *.gemspec
           gem=$(ls *.gem)
           case "$gem" in
@@ -134,18 +140,6 @@ jobs:
           esac
           echo "gem=$gem" >> "$GITHUB_OUTPUT"
 
-      - name: Dry run
-        if: ${{ env.DRY_RUN == 'true' }}
-        env:
-          RUBYGEMS_CREDENTIALS: ${{ secrets.RUBYGEMS_CREDENTIALS }}
-        run: |
-          git diff --stat
-          if ! grep -q '^:rubygems_api_key: [^ ]' <<< "$RUBYGEMS_CREDENTIALS"; then
-            echo "::error::The RUBYGEMS_CREDENTIALS secret must hold the contents of a gem credentials file: ':rubygems_api_key: rubygems_…'"
-            exit 1
-          fi
-          echo "RUBYGEMS_CREDENTIALS looks like a gem credentials file. A release pushes with it, nothing more to verify without pushing."
-
       - name: Commit and tag
         if: ${{ env.DRY_RUN != 'true' && env.RELEASE != 'retry' }}
         env:
@@ -166,11 +160,13 @@ jobs:
   release:
     name: Publish
     needs: build
-    if: ${{ github.event_name == 'workflow_dispatch' && !inputs.dry_run }}
+    # The rubygems environment only admits main, so dry runs from other branches stop after the build
+    if: ${{ github.ref == 'refs/heads/main' }}
     runs-on: ubuntu-24.04
     environment: rubygems
     permissions:
       contents: write # creates the GitHub release
+      id-token: write # OIDC token exchange with RubyGems.org
     env:
       VERSION: ${{ needs.build.outputs.version }}
       GEM: ${{ needs.build.outputs.gem }}
@@ -185,20 +181,28 @@ jobs:
         with:
           ruby-version: "3"
 
+      # Exchanges the job's OIDC token for a short-lived RubyGems.org API key and hands it to
+      # `gem push`. Fails when no trusted publisher on rubygems.org matches this workflow.
+      - uses: rubygems/configure-rubygems-credentials@v2.1.0
+
+      - name: Dry run
+        if: ${{ env.DRY_RUN == 'true' }}
+        run: |
+          ls -l "$GEM"
+          echo "RubyGems.org accepted the OIDC token: the trusted publisher matches this workflow. Nothing is pushed."
+
       - name: Push to RubyGems.org
-        env:
-          RUBYGEMS_CREDENTIALS: ${{ secrets.RUBYGEMS_CREDENTIALS }}
+        if: ${{ env.DRY_RUN != 'true' }}
         run: |
           name="${GEM%-$VERSION.gem}"
           if gem specification --remote "$name" --version "$VERSION" > /dev/null 2>&1; then
             echo "$name $VERSION is on rubygems.org already, finishing the release."
           else
-            mkdir -p ~/.gem
-            (umask 077 && printf '%s\n' "$RUBYGEMS_CREDENTIALS" > ~/.gem/credentials)
             gem push "$GEM"
           fi
 
       - name: Create GitHub release
+        if: ${{ env.DRY_RUN != 'true' }}
         env:
           GH_TOKEN: ${{ github.token }}
           GH_REPO: ${{ github.repository }}

data/lib/logtail/log_devices/http.rb

@@ -119,13 +119,13 @@ module Logtail
       # Closes the log device, cleans up, and attempts one last delivery.
       def close
         # Kill the flush thread immediately since we are about to flush again.
-        @flush_thread.kill if @flush_thread
+        @flush_thread.kill.join if @flush_thread
 
         # Flush all remaining messages
         flush
 
         # Kill the request queue thread. Flushing ensures that no requests are pending.
-        @request_outlet_thread.kill if @request_outlet_thread
+        @request_outlet_thread.kill.join if @request_outlet_thread
       end
 
       def deliver_one(msg)

data/lib/logtail/version.rb

@@ -1,3 +1,3 @@
 module Logtail
-  VERSION = "0.1.18"
+  VERSION = "0.1.19"
 end

data/spec/logtail/log_devices/http_spec.rb

@@ -57,10 +57,8 @@ describe Logtail::LogDevices::HTTP do
       http.send(:ensure_flush_threads_are_started)
       http.close
       thread = http.instance_variable_get(:@flush_thread)
-      sleep 0.1 # too fast!
       expect(thread).to_not be_alive
       thread = http.instance_variable_get(:@request_outlet_thread)
-      sleep 0.1 # too fast!
       expect(thread).to_not be_alive
     end
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: logtail
 version: !ruby/object:Gem::Version
-  version: 0.1.18
+  version: 0.1.19
 platform: ruby
 authors:
 - Better Stack