Configure RubyGems Trusted Publishing

[rhenium]

Added .github/workflows/push_gem.yml based on that of net-imap and psych.

If nothing goes wrong, pushing a tag named v* should publish openssl-.gem and openssl--java.gem to rubygems.org, and create a draft GitHub release.

See also: ruby/net-imap#265

This is not tested yet.

[hsbt]

@rhenium Should I prepare @matzbot credential for GitHub releases?

[rhenium]

@rhenium Should I prepare @matzbot credential for GitHub releases?

Actually, I didn't understand that part while looking at the workflow in psych, webrick, etc. Isn't the default secrets.GITHUB_TOKEN token supposed to be able to create a GitHub release?

[hsbt]

I also not sure about secrets.GITHUB_TOKEN with release workflow. It may resolve you or account who invoke git push --tag.

BTW, I prepared to use secrets.MATZBOT_GITHUB_WORKFLOW_TOKEN in this repository. You can use that.

[segiddins]

No special token should be needed, please use secrets.GITHUB_TOKEN, a PAT won't work for getting an id token from GitHub actions

[rhenium]

ruby/net-imap and ruby/net-ftp use secrets.GITHUB_TOKEN for it and have published several releases already, so I'll give it a try.

https://github.com/ruby/net-imap/blob/3094fcc0520ad2b53e0d619830d816a683847207/.github/workflows/push_gem.yml
https://github.com/ruby/net-ftp/blob/cd19a243b1a742a05d0d4608bf9bee36c1e8f1d1/.github/workflows/push_gem.yml

[rhenium]

v3.2.1 has been released to rubygems.org using this workflow: https://rubygems.org/gems/openssl/versions/3.2.1

The -java version failed for some reason. I manually built the stub gem and pushed it to rubygems.org.

https://github.com/ruby/openssl/actions/runs/12393510385/job/34594907881

[rhenium]

The error with building -jruby version seems to be due to a bug fixed in jruby/jruby#8502 (to be included in JRuby 9.4.10.0).