dependabot-core
dependabot-core copied to clipboard
Configure a trusted publisher for RubyGems
Code improvement description
In December 2023 RubyGems announced trusted publishing^1. It allows you to swap a GitHub token for a RubyGems token, and eliminates the need to keep around long-lived RubyGems API tokens.
In order to configure it, someone needs to configure the publisher (GitHub Actions workflows) that is allowed to publish those gems^2.
Once that's done for all the gems published from gems-release-to-rubygems.yml we need to switch to using the rubygems/configure-rubygems-credentials action, and can revoke the RUBYGEMS_API_KEY_WITH_SCOPE_LIMITED_TO_PUSH secret :tada: