From cced668270f53c87fbca2f406a91ff217064badd Mon Sep 17 00:00:00 2001 From: Ronald Tse Date: Sat, 24 Oct 2026 23:31:48 +0800 Subject: [PATCH] =?UTF-8?q?fix(release):=20publish=20via=20OIDC=20trusted?= =?UTF-8?q?=20publishing=20(release-gem@v1)=20=E2=80=94=20the=20API-key=20?= =?UTF-8?q?secret=20does=20not=20exist=20on=20this=20repo?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .github/workflows/release.yml | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 0767efa6..444b14e2 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -35,11 +35,10 @@ jobs: cp interscript-*.gem pkg/ ls -la pkg/ - - name: Publish to rubygems.org - env: - RUBYGEMS_API_KEY: ${{ secrets.INTERSCRIPT_RUBYGEMS_API_KEY }} - run: | - mkdir -p ~/.gem - printf -- "---\n:rubygems_api_key: %s\n" "$RUBYGEMS_API_KEY" > ~/.gem/credentials - chmod 0600 ~/.gem/credentials - gem push pkg/interscript-*.gem + - name: Publish to rubygems.org (trusted publishing) + # Org law: OIDC trusted publishing, never API-key tokens. Requires + # the one-time rubygems.org trusted-publisher registration for + # this repo + workflow. + permissions: + id-token: write + uses: rubygems/release-gem@v1