release_ceremony 1.0.0 → 1.0.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e73ee4ce1ed15cf0e500cf1599d8cd2c288ca37cffd4ef8c5f2267dcfb9f9653
-  data.tar.gz: 87d220e6796d3acd7455651f4340215e7b0f5e4ad6927f8343dd373b8ca84b74
+  metadata.gz: 15c43fac7dba19c918054427d55e8799a7c029c347d487f3ef89428195112bd3
+  data.tar.gz: 43ca6ea3adcb1e615d0ca25c56f4bbb97aeaff3a6582897e6031fd8eb9e478b6
 SHA512:
-  metadata.gz: 797b5474be23312a9d7f430338a57744f525e5c2226a7122a98dedc5c48fff62af7cc4a9132e7ff3edf67ef1c4777066300181b06e46312105990a18ad0cc708
-  data.tar.gz: d9dba2117e6ba35a3ec8060c036e58f22eee3ffed0d56492b7708b8ff50e34998566c93db23a65bf6d0cf0da146eae94fdce190bf1f35af46475fb189b459b2d
+  metadata.gz: 88bcf75134463e12229886c261bd79d49965d87301a6ceec800f5712ba50ce9822a4e200a70c1b94851a1ec31e6490bb41c30d369a6dbfc45d4891e07b33289b
+  data.tar.gz: cf437bd36a3b1e3c1f29797d0331ceadb4bafdb0648731d190efc77bb5a3df4faa4643043be337fbc3e20c047498cddd59f13260910294fc28802287dde0e3dd

data/CHANGELOG.md

@@ -8,6 +8,16 @@ and this project adheres to
 
 ## [Unreleased]
 
+## [1.0.1] - 2026-07-25
+
+### Fixed
+
+- Child commands no longer inherit the ceremony's own Bundler environment.
+  Running the ceremony with `bundle exec` used to leak `RUBYOPT` and the
+  `BUNDLE_*` variables into the verification commands, so a nested
+  `bundle install` crashed with a `LoadError` in the `bundle` executable.
+  Every command now runs in an unbundled environment when Bundler is loaded.
+
 ## [1.0.0] - 2026-07-25
 
 ### Added
@@ -24,5 +34,6 @@ and this project adheres to
   overrides in `.release_ceremony.yml` (release file paths, verification
   commands, workflow file, default branch, and remote).
 
-[Unreleased]: https://github.com/dominicsayers/release_ceremony/compare/v1.0.0...HEAD
+[Unreleased]: https://github.com/dominicsayers/release_ceremony/compare/v1.0.1...HEAD
+[1.0.1]: https://github.com/dominicsayers/release_ceremony/compare/v1.0.0...v1.0.1
 [1.0.0]: https://github.com/dominicsayers/release_ceremony/compare/v0.0.0...v1.0.0

data/README.md

@@ -20,17 +20,19 @@ until you type the confirmation phrase.
 ## The ceremony
 
 ```sh
-git switch -c release-v1.2.3
-release_ceremony prepare 1.2.3
+VERSION=1.2.3
+
+git switch -c "release-v$VERSION"
+release_ceremony prepare "$VERSION"
 # inspect the changes, then commit and push the branch
 # open the pull request and merge it
-release_ceremony publish 1.2.3
+release_ceremony publish "$VERSION"
 ```
 
 Publication itself happens in CI: the pushed tag triggers your release
-workflow, which should publish to RubyGems (for example with
-[Trusted Publishing](https://guides.rubygems.org/trusted-publishing/) and the
-`rubygems/release-gem` action). `publish` only tags, watches, and verifies.
+workflow, which should publish to RubyGems (see
+[Setting up Trusted Publishing](#setting-up-trusted-publishing)). `publish`
+only tags, watches, and verifies.
 
 ## Installation
 
@@ -60,6 +62,59 @@ The gem name and repository URL are read from the repository's gemspec
 (`metadata['source_code_uri']`, falling back to `homepage`). Everything else
 above is a convention that `.release_ceremony.yml` can override.
 
+## Setting up Trusted Publishing
+
+`publish` never pushes to RubyGems itself; the tag-triggered workflow does,
+ideally with [Trusted Publishing](https://guides.rubygems.org/trusted-publishing/)
+and the [`rubygems/release-gem`](https://github.com/rubygems/release-gem)
+action, so that no API key exists to be stored or leaked. One-time setup:
+
+- **Existing gem**: on rubygems.org, open the gem → Trusted publishers →
+  Create, and enter the repository owner and name, the workflow filename
+  (e.g. `release.yml`), and the environment name the workflow declares
+  (e.g. `release`).
+- **New gem**: nothing is created on RubyGems manually. Instead, register a
+  [pending trusted publisher](https://rubygems.org/profile/oidc/pending_trusted_publishers)
+  (Profile → OIDC → Pending trusted publishers) with the same fields plus the
+  gem's name. The first successful push from the workflow creates the gem,
+  converts the pending publisher into a normal one, and makes you the owner.
+  Pending publishers expire 12 hours after creation, so register on the day
+  of the first release; if it lapses, just register it again.
+- **GitHub environment**: if the workflow's publish job declares
+  `environment: release`, create that environment in the repository settings
+  (Settings → Environments). Trusted Publishing only accepts tokens minted
+  from the registered environment, and you can attach protection rules such
+  as required reviewers to it.
+
+RubyGems also ships a CLI that automates the RubyGems side:
+[`gem exec configure_trusted_publisher`](https://github.com/rubygems/configure_trusted_publisher).
+
+## Re-running publish
+
+`publish` converges when reality matches expectations and stops loudly when
+it doesn't, so after most failures you can simply run it again:
+
+- Everything before the confirmation prompt is read-only validation; a
+  failure there has changed nothing.
+- Tagging is guarded: if the remote tag already exists at the merge commit,
+  tagging and pushing are skipped; if only a local tag exists, it is pushed
+  as-is. A tag that exists anywhere but points to the wrong commit aborts the
+  ceremony before the prompt — `publish` never moves or deletes a tag.
+- Watching the workflow and checking RubyGems are read-only, so a run that
+  died mid-watch or hit RubyGems index lag re-attaches to the completed
+  workflow run and re-verifies. Re-running after a fully successful publish
+  succeeds again without side effects.
+
+The exception is a failed release workflow. Re-running `publish` does not
+retry it: the tag is already on the remote, so nothing re-pushes, no new
+workflow is triggered, and watching the same failed run fails again. Re-run
+the workflow first, then re-run `publish` to watch and verify it:
+
+```sh
+gh run rerun <run-id> --failed
+release_ceremony publish "$VERSION"
+```
+
 ## Configuration
 
 Create `.release_ceremony.yml` in the repository root to override any of the

data/lib/release_ceremony/runner.rb

@@ -16,7 +16,7 @@ module ReleaseCeremony
 
     def capture(*command)
       validate_command!(command)
-      captured_stdout, captured_stderr, status = Open3.capture3(*command)
+      captured_stdout, captured_stderr, status = unbundled { Open3.capture3(*command) }
       return captured_stdout if status.success?
 
       raise_command_error(command, captured_stderr)
@@ -26,7 +26,7 @@ module ReleaseCeremony
 
     def run(*command)
       validate_command!(command)
-      result = system(*command)
+      result = unbundled { system(*command) }
       return true if result
 
       result.nil? ? raise_spawn_error(command) : raise_command_error(command)
@@ -56,6 +56,20 @@ module ReleaseCeremony
 
     private
 
+    # The ceremony normally runs under bundle exec, but its child processes
+    # must not inherit that Bundler context: a nested bundle command crashes
+    # when RUBYOPT and the BUNDLE_* variables point at the ceremony's own
+    # bundle instead of the repository being released
+    def unbundled(&)
+      return yield unless bundler_loaded?
+
+      Bundler.with_unbundled_env(&)
+    end
+
+    def bundler_loaded?
+      !defined?(Bundler).nil?
+    end
+
     def validate_command!(command)
       return if command.length > 1 && command.all?(String)
 

data/lib/release_ceremony/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module ReleaseCeremony
-  VERSION = '1.0.0'
+  VERSION = '1.0.1'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: release_ceremony
 version: !ruby/object:Gem::Version
-  version: 1.0.0
+  version: 1.0.1
 platform: ruby
 authors:
 - Dominic Sayers