Skip to content

Create gem-push.yml workflow #44

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
samsarkleio merged 3 commits into from
May 26, 2021
Merged

Create gem-push.yml workflow #44

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
a843199
Create gem-push.yml workflow
samsarkleio May 25, 2021
4137e68
Update gem-push.yml
samsarkleio May 25, 2021
ed32d54
Update gem-push.yml
samsarkleio May 25, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
30 changes: 30 additions & 0 deletions .github/workflows/gem-push.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,30 @@
name: Ruby Gem

on:
release:
types: [ published ]

jobs:
build:
name: Build + Publish
runs-on: ubuntu-latest
permissions:
contents: read
Comment on lines +11 to +12
Copy link
Contributor

@alecclarke alecclarke May 25, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not a required change, but I believe @npaufler set the default Actions permission to read, so I think we get read by default.


steps:
- uses: actions/checkout@v2
- name: Set up Ruby 2.6
uses: actions/setup-ruby@v1
with:
ruby-version: 2.6.x

- name: Publish to RubyGems
env:
GEM_HOST_API_KEY: "${{secrets.RUBYGEMS_AUTH_TOKEN}}"
run: |
mkdir -p $HOME/.gem
touch $HOME/.gem/credentials
chmod 0600 $HOME/.gem/credentials
printf -- "---\n:rubygems_api_key: ${GEM_HOST_API_KEY}\n" > $HOME/.gem/credentials
Copy link
Contributor

@alecclarke alecclarke May 25, 2021 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Will this log the token to the Action's artifacts (where it can be viewed by any contributor)? If so, can it be used maliciously?

Copy link
Contributor

@peerkleio peerkleio May 25, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Its a push only API token and you can't replace an existing gem version in rubygems.org. This should not end up in artifacts from what I understand. This is literally the supplied code from GitHub for implementing this action.

Copy link
Contributor Author

@samsarkleio samsarkleio May 25, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The above line puts the credentials in a file, it won't be logged/printed anywhere.

Copy link
Contributor

@alecclarke alecclarke May 25, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah! Thanks for the explanation! That was the piece I was missing.

gem build *.gemspec
gem push *.gem