chore(release): move configuration binding to v0.6.0 #7
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| # Publishes to RubyGems via Trusted Publishing (OIDC). No API key exists in this | |
| # repository, in Actions secrets, or in Doppler. | |
| # | |
| # This matters more here than on any other registry: seatlayer.gemspec sets | |
| # `rubygems_mfa_required = "true"`, so a plain `gem push` demands an interactive | |
| # OTP every single time and cannot be automated at all. Trusted Publishing | |
| # satisfies the MFA requirement WITHOUT the prompt. It is the only way this gem | |
| # ships from CI. | |
| # | |
| # To release: push a tag matching lib/seatlayer/version.rb. | |
| # | |
| # git tag v0.1.0 && git push origin v0.1.0 | |
| on: | |
| push: | |
| tags: ["v*"] | |
| permissions: {} | |
| jobs: | |
| build: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: ruby/setup-ruby@v1 | |
| with: | |
| ruby-version: "3.4" | |
| bundler-cache: true | |
| - name: Gate | |
| run: | | |
| bundle exec rubocop | |
| bundle exec rspec | |
| - name: Refuse to publish if the tag and VERSION disagree | |
| run: | | |
| tag="${GITHUB_REF_NAME#v}" | |
| ver="$(ruby -r ./lib/seatlayer/version -e 'print SeatLayer::VERSION')" | |
| if [ "$tag" != "$ver" ]; then | |
| echo "::error::tag v$tag does not match SeatLayer::VERSION $ver" | |
| exit 1 | |
| fi | |
| - name: Build | |
| run: | | |
| rm -f ./*.gem | |
| gem build seatlayer.gemspec | |
| - name: The gem must ship the library and nothing else | |
| run: | | |
| # `files` in the gemspec is explicit globs, never `git ls-files`, so | |
| # spec/, .github/, .rubocop.yml, Gemfile and AGENTS.md stay out. This | |
| # asserts that stays true — a stowaway reaches every consumer's bundle. | |
| tar -xOf ./seatlayer-*.gem data.tar.gz | tar tz | sort > /tmp/contents.txt | |
| cat /tmp/contents.txt | |
| if grep -qE '^(spec/|\.github/|AGENTS\.md|Gemfile|\.rubocop\.yml)' /tmp/contents.txt; then | |
| echo "::error::repo-only files found in the gem" | |
| exit 1 | |
| fi | |
| count=$(wc -l < /tmp/contents.txt) | |
| if [ "$count" -ne 12 ]; then | |
| echo "::error::expected 12 files in the gem, found $count" | |
| exit 1 | |
| fi | |
| - uses: actions/upload-artifact@v4 | |
| with: | |
| name: gem | |
| path: ./*.gem | |
| publish: | |
| needs: build | |
| runs-on: ubuntu-latest | |
| environment: | |
| name: rubygems | |
| url: https://rubygems.org/gems/seatlayer | |
| permissions: | |
| # Required for OIDC, and scoped to the job that actually publishes. | |
| id-token: write | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: ruby/setup-ruby@v1 | |
| with: | |
| ruby-version: "3.4" | |
| - uses: actions/download-artifact@v4 | |
| with: | |
| name: gem | |
| # Exchanges the GitHub OIDC token for short-lived RubyGems credentials. | |
| # Pinned to a SHA rather than a moving tag: this action is the one step | |
| # that can push under our identity, so it is exactly the wrong place to | |
| # trust a tag someone else can repoint. This is the same SHA that | |
| # rubygems/release-gem pins internally. | |
| # | |
| # NOT rubygems/release-gem, despite that being the headline action: it | |
| # runs `bundle exec rake release`, which builds AND creates and pushes the | |
| # git tag itself. This workflow is triggered BY the tag, so that would | |
| # collide — and there is no Rakefile here for it to run. | |
| - uses: rubygems/configure-rubygems-credentials@dc5a8d8553e6ee01fc26761a49e99e733d17954a # v2.1.0 | |
| - run: gem push ./*.gem |