build: semi-automated release process by extern-c · Pull Request #80 · CycloneDX/cyclonedx-ruby-gem

extern-c · 2026-07-01T03:34:07Z

Description

Add a release workflow for RubyGems and GitHub Releases triggered by version tags (v*.*.*).

This PR resolves issue: #46.

The workflow consists of three jobs:

Test: runs the test suite using Ruby 3.3.
RubyGems Release: publishes the gem to RubyGems using trusted publishing.
GitHub Release: creates a GitHub Release with generated release notes.

~~The GitHub Release does not include a built gem package and is intended only for release metadata and assets.~~

Future Improvements

To keep this change focused, a few related enhancements are left for follow-up work:

Verify that the gem version matches the release tag before publishing.
Ensure the tagged commit is reachable from a protected release branch (e.g. main) before publishing to reduce the risk of releasing from an unreviewed commit outside the normal development workflow.
Generate and publish SHA hashes for release assets.
~~Document the release process (e.g. updating the gem version, creating and publishing a release tag, and publishing a release).~~ Updated CONTRIBUTING.md in commit 5545c7c.

~~Release documentation will be added in a follow-up PR.~~

Testing

The workflow has been validated to the extent possible, but I was unable to perform an end-to-end test for the RubyGems publishing step because trusted publishing requires maintainer-controlled RubyGems and repository configuration.

A maintainer will need to:

Create and configure a release environment if one does not already exist.
Configure RubyGems trusted publishing for the repository/environment.
Perform a test release to verify that the trusted publishing configuration is set up correctly.

AI Tool Disclosure

My contribution does not include any AI-generated content
My contribution includes AI-generated content, as disclosed below:
- AI Tools: [e.g. GitHub CoPilot, ChatGPT, JetBrains Junie etc.]
- LLMs and versions: [e.g. GPT-4.1, Claude Haiku 4.5, Gemini 2.5 Pro etc.]
- Prompts: [Summarize the key prompts or instructions given to the AI tools]

Affirmation

My code follows the CONTRIBUTING.md guidelines

codacy-production · 2026-07-01T03:37:01Z

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer}
_{TIP This summary will be updated as you push new changes.}

Signed-off-by: Amauri Bizerra <10775696+extern-c@users.noreply.github.com>

jkowalleck

the release process looks very promising. 👍

Release documentation will be added in a follow-up PR.

Docs shall happen when changes happen.

Could you please add some docs how this all works and how it is triggered?
This might go here: CONTRIBUTING.md section "To release a new version".
You might want to remove the "Manual process" and add a "Semi-Automated process" or whatever sounds appropriate

please also add a description of the build changes to CHANGELOG.md

jkowalleck · 2026-07-03T07:07:40Z

+    needs: rubygems_release
+    environment: release
+    permissions:
+      contents: write


please add a comment why this permission is needed

Addressed in e3c2541. Thanks for the suggestion.

jkowalleck · 2026-07-03T07:08:03Z

+    timeout-minutes: 10
+    needs: test
+    permissions:
+      contents: write


please add comments why the permissions are needed

Addressed in 51b50f1. Thanks for the suggestion.

jkowalleck · 2026-07-03T07:19:58Z

+          persist-credentials: false
+      - name: Create GitHub Release
+        run: |
+          gh release create "${{ github.ref_name }}" \


Suggested change

gh release create "${{ github.ref_name }}" \

gh release create "$GITHUB_REF_NAME" \

see

Addressed in 2106cb1. Thanks for the suggestion.

jkowalleck · 2026-07-03T07:20:50Z

+        with:
+          persist-credentials: false
+      - name: Create GitHub Release
+        run: |


please rework this to

run: > gh release create ... --verify-tag ...

Please see 9e50640.

jkowalleck · 2026-07-03T07:21:38Z

+          ruby-version: ruby
+          bundler-cache: false
+      - name: "Push gem to RubyGems"
+        uses: rubygems/release-gem@6317d8d1f7e28c24d28f6eff169ea854948bd9f7 # v1.2.0


please add a comment with the action's URL for easier docks lookup when maintaining.

Addressed in da61dd3. Thanks for the suggestion.

jkowalleck · 2026-07-03T07:38:26Z

+        run: |
+          gh release create "${{ github.ref_name }}" \
+            --verify-tag \
+            --generate-notes


I'd love to see the "--prerelease" marker in case the tag looks like one.
This will be especially needed to test the release process before merging the PR.

Possible way to do this: similar to https://github.com/CycloneDX/cyclonedx-buildroot/blob/main/.github/workflows/release.yml

add a new job that determines whether this is a prerelease

do a pattern-math on the version string

set an output parameter properly

have the release process depend on the newly added job

when creating the GH release: reflect on the outcome and flag as prerelease if needed

Implemented in 9e50640.

jkowalleck · 2026-07-03T07:40:12Z

+
+on:
+  push:
+    tags: ["v*"]


maybe better go with

Suggested change

tags: ["v*"]

tags: ["v*.*.*"]

Addressed in 3e9e0ba. Thanks for the suggestion.

jkowalleck · 2026-07-03T07:43:25Z

+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - name: Create GitHub Release


could the release have the gem as a release asset?
It would be ideal to use the one produced in the rubygems_release job - you could use https://docs.github.com/en/actions/concepts/workflows-and-actions/workflow-artifacts to transfer a file from one job to the other. (artifact lifetime of 1 day should be enough)

Would you be okay with deferring this for now? I don't think it's necessary to include the built gem in the GitHub release since it'll already be published to RubyGems, and anyone can build it from the release assets. AFAIK, rubygems/release-gem does not produce a build artifact, so we'd need to add additional steps to build the gem and upload it separately.

just artifact pkg/*.gem at the end of the rubygems_release should work, right?

I mean, rubygems/release-gem does not do any magic, it just calls bundle exec rake release which will cause emitting files pkg/*.gem.
see https://github.com/rubygems/release-gem/blob/052cc82692552de3ef2b81fd670e41d13cba8092/action.yml#L60-L67

I rechecked the rubygems/release-gem behavior and think that the generated gem remains available after the release step, so it should be reusable as you suggested 👍. See commit 2af378b.

Signed-off-by: Amauri Bizerra <10775696+extern-c@users.noreply.github.com>

Copilot

Pull request overview

Adds a new GitHub Actions workflow to run tests and perform a semi-automated release flow on version tag pushes, targeting RubyGems (trusted publishing) and GitHub Releases.

Changes:

Introduces a Release workflow triggered on version tag pushes.
Adds a test job that runs the rake default task on Ruby 3.3.9 before releasing.
Adds jobs to publish to RubyGems via trusted publishing and create a GitHub Release with generated notes.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

extern-c · 2026-07-11T11:50:11Z

+
+on:
+  push:
+    tags: ["v*.*.*"]


The PR description has been updated to reflect the actual tag trigger.

extern-c · 2026-07-10T22:46:45Z

+permissions:
+  contents: read


Addressed in a7352f6.

extern-c · 2026-07-11T11:44:48Z

+        # see https://github.com/ruby/setup-ruby
+        uses: ruby/setup-ruby@9eb537ca036ebaed86729dcb9309076e4c5c3b74 # v1.314.0
+        with:
+          ruby-version: ruby


Addressed in 98c2176.

extern-c · 2026-07-08T11:29:16Z

+    timeout-minutes: 10
+    needs: test
+    permissions:
+      contents: write # Required for `rake release` to perform git synchronization.


This is intentional. This CI job follows the rubygems/release-gem usage documentation. Although actions/checkout is configured with persist-credentials: false, the rubygems/release-gem action configures Git authentication itself using github.token (its token input defaults to ${{ github.token }}). See:

https://github.com/rubygems/release-gem#usage
https://github.com/rubygems/release-gem/blob/v1/action.yml#L10

Signed-off-by: Amauri Bizerra <10775696+extern-c@users.noreply.github.com>

jkowalleck · 2026-07-11T16:23:14Z

will review in a week, please ping me if this is ready.
after review, I might trigger a pre-release of this :-)

Copilot

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 3 comments.

extern-c · 2026-07-12T02:01:25Z

+on:
+  push:
+    tags: ["v*.*.*"]
+


I believe bundle exec rake release already handles this case by checking whether the version tag exists before attempting to create it. See the relevant implementation in Bundler's GemHelper:

https://github.com/ruby/rubygems/blob/v3.6.9/bundler/lib/bundler/gem_helper.rb#L67

https://github.com/ruby/rubygems/blob/v3.6.9/bundler/lib/bundler/gem_helper.rb#L76.

So a workflow triggered by an existing tag shouldn't fail simply because the tag is already present.

extern-c · 2026-07-16T23:48:22Z

+        uses: ruby/setup-ruby@9eb537ca036ebaed86729dcb9309076e4c5c3b74 # v1.314.0
+        with:
+          ruby-version: '3.4' # Stable environment to package the gem for the supported ruby versions
+          bundler-cache: false


I don't think this adds much value here, but let me know if you think it's worth pinning.

extern-c · 2026-07-16T23:44:31Z

+          # Determine release type from tag suffix
+          if [[ "$GITHUB_REF_NAME" =~ -(alpha|beta|rc|pre)[0-9.]*$ ]]; then
+            FLAGS+=("--prerelease")
+          fi


@jkowalleck, do you want to support dot-separated prerelease tags (e.g. v1.2.3.pre.1)?

Signed-off-by: Amauri Bizerra <10775696+extern-c@users.noreply.github.com>

extern-c · 2026-07-16T03:58:55Z

the release process looks very promising. 👍

Release documentation will be added in a follow-up PR.

Docs shall happen when changes happen.

Could you please add some docs how this all works and how it is triggered? This might go here: CONTRIBUTING.md section "To release a new version". You might want to remove the "Manual process" and add a "Semi-Automated process" or whatever sounds appropriate

please also add a description of the build changes to CHANGELOG.md

I've updated CHANGELOG.md and CONTRIBUTING.md in commits e92d1bd and 5545c7c, respectively.

Signed-off-by: Amauri Bizerra <10775696+extern-c@users.noreply.github.com>

extern-c · 2026-07-17T01:28:05Z

will review in a week, please ping me if this is ready. after review, I might trigger a pre-release of this :-)

@jkowalleck, this is now ready for review.

extern-c force-pushed the ci-release branch 3 times, most recently from f94b6a6 to e19047f Compare July 1, 2026 03:44

Implement Release workflow

b22ec67

Signed-off-by: Amauri Bizerra <10775696+extern-c@users.noreply.github.com>

extern-c force-pushed the ci-release branch from e19047f to d51d86c Compare July 2, 2026 21:58

Implement rubygems_release CI job

90ac387

Signed-off-by: Amauri Bizerra <10775696+extern-c@users.noreply.github.com>

extern-c force-pushed the ci-release branch from d51d86c to 90ac387 Compare July 2, 2026 21:59

Bump actions/checkout from v6.0.2 to v7.0.0

4f806b7

Signed-off-by: Amauri Bizerra <10775696+extern-c@users.noreply.github.com>

extern-c marked this pull request as ready for review July 2, 2026 23:30

extern-c requested a review from a team as a code owner July 2, 2026 23:30

Bump ruby/setup-ruby GHA from v1.310.0 to v1.314.0

7ff9329

Signed-off-by: Amauri Bizerra <10775696+extern-c@users.noreply.github.com>

jkowalleck requested changes Jul 3, 2026

View reviewed changes

jkowalleck reviewed Jul 3, 2026

View reviewed changes

jkowalleck changed the title ~~Add release workflow~~ build: semi-automated release process Jul 3, 2026

jkowalleck added the chore label Jul 3, 2026

extern-c added 3 commits July 4, 2026 11:20

Replace github.ref_name with GITHUB_REF_NAME in release job

2106cb1

Signed-off-by: Amauri Bizerra <10775696+extern-c@users.noreply.github.com>

Trigger release workflow only on vMAJOR.MINOR.PATCH tags

3e9e0ba

Signed-off-by: Amauri Bizerra <10775696+extern-c@users.noreply.github.com>

Add comment explaining required permissions for GitHub Releases

e3c2541

Signed-off-by: Amauri Bizerra <10775696+extern-c@users.noreply.github.com>

extern-c force-pushed the ci-release branch from 1a53a95 to e3c2541 Compare July 4, 2026 14:51

extern-c added 3 commits July 4, 2026 19:17

Add comments explaining required permissions for RubyGems Releases

51b50f1

Signed-off-by: Amauri Bizerra <10775696+extern-c@users.noreply.github.com>

Add comment with rubygems/release-gem GHA project URL

da61dd3

Signed-off-by: Amauri Bizerra <10775696+extern-c@users.noreply.github.com>

Add support for creating GitHub pre-releases

9e50640

Signed-off-by: Amauri Bizerra <10775696+extern-c@users.noreply.github.com>

jkowalleck requested a review from Copilot July 7, 2026 15:27

Copilot started reviewing on behalf of jkowalleck July 7, 2026 15:28 View session

Copilot AI reviewed Jul 7, 2026

View reviewed changes

extern-c added 2 commits July 10, 2026 22:27

Drop global permissions to empty set in release workflow

a7352f6

Signed-off-by: Amauri Bizerra <10775696+extern-c@users.noreply.github.com>

Lock rubygems_release ci job to Ruby 3.4 for build stability

98c2176

Signed-off-by: Amauri Bizerra <10775696+extern-c@users.noreply.github.com>

jkowalleck requested review from Copilot and jkowalleck July 11, 2026 16:21

Copilot started reviewing on behalf of jkowalleck July 11, 2026 16:21 View session

Copilot AI reviewed Jul 11, 2026

View reviewed changes

extern-c added 3 commits July 15, 2026 23:38

Add built gem as GitHub release asset

2af378b

Signed-off-by: Amauri Bizerra <10775696+extern-c@users.noreply.github.com>

Add changelog entry for release workflow

e92d1bd

Signed-off-by: Amauri Bizerra <10775696+extern-c@users.noreply.github.com>

Update release process in CONTRIBUTING.md

5545c7c

Signed-off-by: Amauri Bizerra <10775696+extern-c@users.noreply.github.com>

extern-c added 2 commits July 16, 2026 04:09

Fix Markdown warning in CONTRIBUTING.md

c1b611c

Signed-off-by: Amauri Bizerra <10775696+extern-c@users.noreply.github.com>

Remove unnecessary quotes from step name

cf5e3d9

Signed-off-by: Amauri Bizerra <10775696+extern-c@users.noreply.github.com>

extern-c closed this Jul 17, 2026

extern-c reopened this Jul 17, 2026

	gh release create "${{ github.ref_name }}" \
	gh release create "$GITHUB_REF_NAME" \

Uh oh!

Uh oh!

Conversation

extern-c commented Jul 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Future Improvements

Testing

AI Tool Disclosure

Affirmation

Uh oh!

codacy-production Bot commented Jul 1, 2026

Up to standards ✅

Uh oh!

jkowalleck left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

extern-c Jul 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jkowalleck commented Jul 11, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

extern-c commented Jul 1, 2026 •

edited

Loading

jkowalleck left a comment •

edited

Loading

extern-c Jul 16, 2026 •

edited

Loading