dependabot-core icon indicating copy to clipboard operation
dependabot-core copied to clipboard

Configure a trusted publisher for RubyGems

Open JamieMagee opened this issue 1 year ago • 0 comments

Code improvement description

In December 2023 RubyGems announced trusted publishing^1. It allows you to swap a GitHub token for a RubyGems token, and eliminates the need to keep around long-lived RubyGems API tokens.

In order to configure it, someone needs to configure the publisher (GitHub Actions workflows) that is allowed to publish those gems^2.

Once that's done for all the gems published from gems-release-to-rubygems.yml we need to switch to using the rubygems/configure-rubygems-credentials action, and can revoke the RUBYGEMS_API_KEY_WITH_SCOPE_LIMITED_TO_PUSH secret :tada:

JamieMagee avatar May 21 '24 04:05 JamieMagee