From 41ccc6a44ddbcec0e906f7afe73a34b1777bee49 Mon Sep 17 00:00:00 2001 From: jmeredithg Date: Tue, 14 Jul 2026 13:51:58 -0700 Subject: [PATCH 1/2] Authenticate release workflow to Cloudsmith via OIDC Push the gem to Cloudsmith (ruby.cloudsmith.io/gusto/gusto) instead of RubyGems, using the same GitHub OIDC -> Cloudsmith token exchange pattern merged in Gusto/virtuous-pdf#452. --- .github/workflows/release.yml | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index ca82750..fe4b30a 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -6,6 +6,7 @@ on: permissions: contents: write # Required for uploading release assets + id-token: write # Required to mint the OIDC token for Cloudsmith auth jobs: publish: @@ -13,6 +14,13 @@ jobs: steps: - uses: actions/checkout@v4 + - name: Authenticate with Cloudsmith via OIDC + uses: cloudsmith-io/cloudsmith-cli-action@v2 + with: + oidc-namespace: "gusto" + oidc-service-slug: "gusto-cloudsmith-write-svc-01" + oidc-auth-only: "true" + - name: Set up Ruby uses: ruby/setup-ruby@v1 with: @@ -21,10 +29,8 @@ jobs: - name: Build gem run: gem build fixture_kit.gemspec - - name: Push to RubyGems - env: - GEM_HOST_API_KEY: ${{ secrets.RUBYGEMS_API_KEY }} - run: gem push fixture_kit-*.gem + - name: Push to Cloudsmith + run: GEM_HOST_API_KEY="Bearer ${CLOUDSMITH_API_KEY}" gem push fixture_kit-*.gem --host https://ruby.cloudsmith.io/gusto/gusto - name: Upload gem to release continue-on-error: true # May fail due to IP allow list restrictions From a8b9b36771e0b44753530c892134f1eff08635e5 Mon Sep 17 00:00:00 2001 From: jmeredithg Date: Tue, 14 Jul 2026 14:07:13 -0700 Subject: [PATCH 2/2] Use https://cloudsmith.io/gusto/gusto as the gem push host --- .github/workflows/release.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index fe4b30a..6f977f7 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -30,7 +30,7 @@ jobs: run: gem build fixture_kit.gemspec - name: Push to Cloudsmith - run: GEM_HOST_API_KEY="Bearer ${CLOUDSMITH_API_KEY}" gem push fixture_kit-*.gem --host https://ruby.cloudsmith.io/gusto/gusto + run: GEM_HOST_API_KEY="Bearer ${CLOUDSMITH_API_KEY}" gem push fixture_kit-*.gem --host https://cloudsmith.io/gusto/gusto - name: Upload gem to release continue-on-error: true # May fail due to IP allow list restrictions