Match release environment to the rubygems.org trusted publisher - #10
Conversation
The v0.6.0 tag push failed at the publish step with "No trusted publisher configured for this workflow found on https://rubygems.org for audience rubygems.org". Every other step passed; the failure was purely the OIDC claim check. RubyGems compares the token's `environment` claim to the trusted publisher record as a plain string. The record is registered as `rubygems.org`, the workflow declared `rubygems`, so nothing matched. The `rubygems.org` in the error text is the audience claim, which is always that value regardless of environment -- easy to read as confirmation that the environment was right. Use `rubygems.org`, which is what familia, otto and bone already use, and adopt their mapping form so the deployment links to the gem page. Document the exact-match requirement and the audience/environment distinction.
|
Required label not found on this PR. |
The previous rewrite led with "the environment is created automatically", which turns a setup step into a no-op: auto-created environments have no protection rules and no branch policy, so a reader who follows that text ends up with nothing gating the release job. State the gating as the required action, and say what it guards -- a job holding `id-token: write` and `contents: write` that runs on any `v*` tag from any ref.
|
A background security review flagged a control regression here. Splitting it: Workflow — not a regression. The old Docs — was a real weakening, now fixed in 3472c81. My rewrite of step 5 led with "the environment is created automatically the first time the workflow runs", turning a setup step into a no-op. Auto-created environments are unprotected, so anyone following that text would have ended up with nothing gating the release job. Step 5 is imperative again and now says what it guards. Pre-existing exposure, not introduced here and not fixed here: no environment in this repo gates the release job today. |
1 participant
Why
The
v0.6.0tag push (run 30524090986) failed at the publish step:Checkout, Ruby setup, the tag/version check and the tests all passed. The failure was entirely the OIDC claim check, and nothing was published.
RubyGems compares the token's
environmentclaim against the trusted publisher record as a plain string. The record is registered with environmentrubygems.org;release.ymldeclaredrubygems. No match, no token.The
rubygems.orgin the error text is the audience claim — always that value, whatever the environment is. It reads like confirmation that the environment was correct, which is what made this hard to spot.What changed
release.ymlusesrubygems.org, in thename:/url:mapping form so the deployment links to the gem page. This matches whatfamilia,ottoandbonealready do;onetime-rubywas the only outlier.docs/releasing.mdrecords the exact-match requirement and the audience/environment distinction, and notes the environment is auto-created on first run rather than needing manual setup.No change to the RubyGems-side record — the repo now matches it.
Follow-ups, not in this PR
v0.6.0still carriesenvironment: rubygems. Publishing 0.6.0 needs the tag moved to a commit containing this fix, or a fresh version.rubygemsenvironment on GitHub is now orphaned (no protection rules) and can be deleted.