Import trusted publisher jobs from ruby/psych

[hsbt]

I would like to apply signing sigstore to json gem.

https://guides.rubygems.org/trusted-publishing/

According to https://segiddins.github.io/are-we-attested-yet/, it is clear that many gems still do not use sigstore including json. It improves to protect supply-chain attack in long term.

This PR prepare to use sigstore via release-gem workflow. This workflow will trigger to publish, signing and create GH release for ruby and jruby when we push new version tag like vX.Y.Z.

@byroot How about this?

[byroot]

@byroot How about this?

I don't really like publishing gems from github. I find the workflow pretty annoying compared to rake release.

But if you think this is important, I can do it. However I'd recommend modifying the Gemfile so that if I run rake release it reminds me to use GitHub (perhaps with some env var to bypass the check just in case).

[byroot]

Are we sure we need this? rake-compiler is already in the gemfile, and I don't remember ever needing to install ruby-maven.

[byroot]

I'm also worried gem install over using the gemfile may break with some update.

[byroot]

Also please update the release procedure in the readme: https://github.com/ruby/json?tab=readme-ov-file#release

[byroot]

You can combine this with the name: Set up Ruby step. e.g.

      - name: Set up Ruby ${{ matrix.ruby }}
        uses: ruby/setup-ruby@v1
        with:
          ruby-version: ${{ matrix.ruby }}
          bundler-cache: true

[byroot]

For regular CI: #845

[hsbt]

I know that but jruby sometimes failed bundle install and build steps while ruby/setup-ruby.

[byroot]

Yeah, it's very annoying.... But I just pushed that change on regular CI and it seems to work?

[byroot]

You might need to use setup-ruby-pkg because JRuby needs ragel:

      - name: Set up Ruby
        uses: ruby/setup-ruby-pkgs@v1
        with:
          ruby-version: ${{ matrix.ruby }}
          apt-get: "${{ startsWith(matrix.ruby, 'jruby') && 'ragel' || '' }}"
          brew: "${{ startsWith(matrix.ruby, 'jruby') && 'ragel' || '' }}"

[hsbt]

I don't really like publishing gems from github.

I'm surprised to hear that from you. I'm okay to withdraw this PR now.

I'm working to expand to sign with sigstore under the ruby organization. I need to consider other workflow to use sigstore without release-gem.

Thanks!

[hsbt]

We can sign sigstore without github actions:

1. Download https://github.com/rubygems/release-gem/blob/v1/rubygems-attestation-patch.rb
2. Run RUBYOPT=-rrubygems-attestation-patch.rb bundle exec rake release

[byroot]

I'm surprised to hear that from you. I'm okay to withdraw this PR now.

Ahah, not sure why :)

What annoys me with GitHub release is that it's just extra steps since I already maintain CHANGELOG.md, and I constantly forget to create the GitHub release.

Granted with your PR, creating the GitHub release would trigger the build and release process so at least it would be better, but then my annoyance is that I nee to push a commit that bump the version and update the CHANGELOG.md, and then go do some clicking.

What would be great DX I think is if that action triggered automatically on pushes to main, I did implement that at Shopify in https://github.com/Shopify/shipit-engine, but don't know if it's possible with GitHub action.

[byroot]

Is there some existing test repo I could use to try to implement automatic release?

[byroot]

I did implement that at Shopify in https://github.com/Shopify/shipit-engine, but don't know if it's possible with GitHub action.

The logic was quite simple: https://github.com/Shopify/shipit-engine/blob/5cf498b2f334bfa68ff86e93f838e9bf1590b797/lib/snippets/release-gem#L46-L61

The task first check if the current version is already publish, and if that's the case just noop and succeed.

[hsbt]

my annoyance is that I need to push a commit that bump the version and update the CHANGELOG.md, and then go do some clicking.

Agreed. Because I replaced changelog file to GitHub releases on repositories that enabled trusted publisher.

My release workflow is:

• bump patch --tag via https://rubygems.org/gems/bump
• git push && git push origin $TAG

Is there some existing test repo I could use to try to implement automatic release?

There is no test repo now. I always tagged X.Y.Z.betaN in prod repo.

[byroot]

There is no test repo now. I always tagged X.Y.Z.betaN in prod repo.

Alright, I'll try to see if I can implement a seemless workflow, and if not we can reopen this PR. I appreciate that you are closing for my convenience, but I'm fine making my life a bit harder if it improves the ecosystem.