ci(ruby): publish to RubyGems with trusted publishing
Maintainers usually reply within 6 days
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 64/100
Research direction
Start with .github/workflows/publish-ruby.yml and review how the current job authenticates to RubyGems. Apply the described OIDC permissions and trusted publishing action, then validate the workflow YAML and run actionlint if available. Done when the next ruby-sdk-v* release publishes from CI without a manual push; the issue notes that this requires the repo owner to register the trusted publisher on RubyGems.
Written by the indexing model from the issue text.
Description
Change type
CI / release workflow
Risk / impact
Low. It only changes how publish-ruby.yml authenticates to RubyGems. Tests and the gem build are unchanged.
Security impact assessed?
Yes. This removes a long-lived RubyGems API key from repo secrets and replaces it with a short-lived, repo- and workflow-scoped token from RubyGems trusted publishing (GitHub OIDC).
Details — description & full context
Problem: the Ruby SDK can't publish from CI. The gemspec sets metadata["rubygems_mfa_required"] = "true", so every push of turbodocx-sdk needs an MFA one-time code, which CI can't provide.
- The
ruby-sdk-v0.8.0publish failed because the repo had noRUBYGEMS_API_KEYsecret. - The
ruby-sdk-v0.9.0publish failed with the secret set:You have enabled multifactor authentication but no OTP code provided. - 0.9.0 was pushed to RubyGems by hand. It is live, and its checksum matches the gem built from the release commit.
Fix: use RubyGems trusted publishing. The job exchanges its GitHub OIDC token for a short-lived RubyGems key. Projects with rubygems_mfa_required report that trusted-publisher keys need no OTP, because the MFA rule only applies to user-owned keys. RubyGems' docs don't say this explicitly, so the next Ruby release is the real check.
Steps:
- Repo owner, on rubygems.org: open
turbodocx-sdk→ Trusted publishers → Create. GitHub Actions, ownerTurboDocx, repositorySDK, workflow filenamepublish-ruby.yml, environment blank. If you set an environment, the job must use the sameenvironment:. - Implementing agent: apply this diff to
.github/workflows/publish-ruby.yml. The action is pinned to the v2.1.0 commit (released 2026-06-12), per the repo's pin-by-SHA rule:
diff --git a/.github/workflows/publish-ruby.yml b/.github/workflows/publish-ruby.yml
index e073ef9..b84319a 100644
--- a/.github/workflows/publish-ruby.yml
+++ b/.github/workflows/publish-ruby.yml
@@ -18,6 +18,12 @@ jobs:
# every registry at once.
if: github.event_name == 'workflow_dispatch' || startsWith(github.event.release.tag_name, 'ruby-sdk-v')
runs-on: ubuntu-latest
+ # Trusted publishing: the job trades its GitHub OIDC token for a short-lived RubyGems
+ # key. The gemspec sets rubygems_mfa_required, so a stored API key can't push (it
+ # needs an OTP); trusted-publisher keys aren't tied to a user and need none.
+ permissions:
+ contents: read
+ id-token: write
defaults:
run:
working-directory: packages/ruby-sdk
@@ -37,7 +43,8 @@ jobs:
- name: Build gem
run: gem build turbodocx-sdk.gemspec
+ - name: Configure RubyGems credentials (trusted publishing)
+ uses: rubygems/configure-rubygems-credentials@dc5a8d8553e6ee01fc26761a49e99e733d17954a # v2.1.0
+
- name: Publish to RubyGems
- env:
- GEM_HOST_API_KEY: ${{ secrets.RUBYGEMS_API_KEY }}
run: gem push turbodocx-sdk-*.gem
- After the first successful trusted-publishing release, delete the
RUBYGEMS_API_KEYrepo secret and revoke that key on rubygems.org.
Acceptance: the next ruby-sdk-v* release publishes to RubyGems from CI with no manual push.
Component / area
.github/workflows/publish-ruby.yml (Ruby SDK release)
Testing & validation
- CI / build passes on the implementing PR (YAML valid; actionlint clean if available)
- The trusted publisher is registered on rubygems.org before the next Ruby release
- The next
ruby-sdk-v*release publishes from CI. If the push still asks for an OTP, the fallback is a manualgem push --otp, or a decision on whether to keeprubygems_mfa_required.
Rollback plan
Revert the workflow change, and publish Ruby by hand with gem push <gem> --otp <code>.
Breaking change for consumers?
No. Release plumbing only.
Reviewer / approver
@nicolasiscoding
🤖 Generated with Claude Code
- Dominant language
- PHP
- Stars
- 1
- Forks
- 0
- Avg merge
- 4d 9h
- Merged PRs (30d)
- 28
Getting set up
- No Dockerfile or Docker Compose file
- No pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from TurboDocx/SDK
-
bug
Difficulty 1/5 Under an hour Newbie friendliness 86/100
Maintainers usually reply within 6 days
-
embed: handleTurboSignMessage header comment says the signing page posts to '*' (it never does)Opendocumentation
Difficulty 2/5 Under an hour Newbie friendliness 82/100
TurboDocx/SDK#95 · 1 comment ·
Maintainers usually reply within 6 days
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
Maintainers usually reply within 6 days
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
Maintainers usually reply within 6 days
-
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
Maintainers usually reply within 6 days
Similar issues
-
sync-en
Difficulty 1/5 Under an hour Newbie friendliness 86/100
Maintainers usually reply within 1 day
-
sync-en
Difficulty 1/5 Under an hour Newbie friendliness 78/100
Maintainers usually reply within 2 days
-
Issue: ready for confirmation
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
-
Перевод устарел
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
LinkStackOrg/LinkStack#1014 · 2 comments ·