|
| 1 | +# frozen_string_literal: true |
| 2 | + |
| 3 | +# Released under the MIT License. |
| 4 | +# Copyright, 2026, by Samuel Williams. |
| 5 | + |
| 6 | +require "json" |
| 7 | +require "rubygems/gemcutter_utilities" |
| 8 | +require "rubygems/user_interaction" |
| 9 | +require "uri" |
| 10 | +require_relative "project" |
| 11 | + |
| 12 | +module Bake |
| 13 | + module Gem |
| 14 | + module GitHub |
| 15 | + # Registers the reviewed release workflow with RubyGems.org using its owner API. |
| 16 | + class TrustedPublisher |
| 17 | + include ::Gem::UserInteraction |
| 18 | + include ::Gem::GemcutterUtilities |
| 19 | + |
| 20 | + # The RubyGems API scope for managing trusted publishers. |
| 21 | + SCOPE = :configure_trusted_publishers |
| 22 | + |
| 23 | + # The provider type accepted by the RubyGems trusted publisher API. |
| 24 | + TYPE = "OIDC::TrustedPublisher::GitHubAction" |
| 25 | + |
| 26 | + # Load the gem identity and reviewed publisher settings from the current project. |
| 27 | + # @parameter root [String] The repository root, which must also be the working directory. |
| 28 | + # @parameter options [Hash] Authentication options passed to {initialize}. |
| 29 | + # @returns [TrustedPublisher] The configured RubyGems client. |
| 30 | + def self.load(root, **options) |
| 31 | + project = Project.new(root) |
| 32 | + name = Helper.new(root).gemspec.name |
| 33 | + |
| 34 | + new(name, project.trusted_publisher, **options) |
| 35 | + end |
| 36 | + |
| 37 | + # Configure an existing gem's expected GitHub Actions publisher. |
| 38 | + # @parameter name [String] The gem name. |
| 39 | + # @parameter settings [Hash] Repository owner/name, workflow filename, and environment. |
| 40 | + # @parameter key [Symbol | Nil] An explicitly selected key in RubyGems credentials. |
| 41 | + # @parameter otp [String | Nil] An optional MFA code; RubyGems can prompt when required. |
| 42 | + def initialize(name, settings, key: nil, otp: nil) |
| 43 | + @path = "api/v1/gems/#{URI.encode_www_form_component(name)}/trusted_publishers" |
| 44 | + @settings = settings.transform_keys(&:to_s) |
| 45 | + @options = {key: key, otp: otp} |
| 46 | + @host = "https://rubygems.org" |
| 47 | + @api_key = nil |
| 48 | + end |
| 49 | + |
| 50 | + # @attribute [Hash] Options used by RubyGems authentication and MFA support. |
| 51 | + attr_reader :options |
| 52 | + |
| 53 | + # Read the matching publisher without changing publisher configuration. |
| 54 | + # @returns [Hash] Whether the publisher is configured and its existing API record, if any. |
| 55 | + # @raises [RuntimeError] If RubyGems cannot list the gem's publishers. |
| 56 | + def status |
| 57 | + sign_in(scope: SCOPE) unless api_key |
| 58 | + publishers = request(:get, expected: "200") |
| 59 | + raise "Invalid RubyGems trusted publishers response." unless publishers.is_a?(Array) |
| 60 | + publisher = publishers.find{|record| matching?(record)} |
| 61 | + |
| 62 | + return {configured: !publisher.nil?, publisher: publisher} |
| 63 | + end |
| 64 | + |
| 65 | + # Register a missing publisher, preserving all existing publisher registrations. |
| 66 | + # @returns [Hash] Whether registration was created and the matching API record. |
| 67 | + # @raises [RuntimeError] If RubyGems rejects registration or returns different settings. |
| 68 | + def register |
| 69 | + current = status |
| 70 | + return {created: false, publisher: current.fetch(:publisher)} if current.fetch(:configured) |
| 71 | + |
| 72 | + publisher = request(:post, expected: "201", payload: {trusted_publisher_type: TYPE, trusted_publisher: @settings}) |
| 73 | + raise "RubyGems returned unexpected trusted publisher settings." unless matching?(publisher) |
| 74 | + |
| 75 | + return {created: true, publisher: publisher} |
| 76 | + end |
| 77 | + |
| 78 | + # Use the session key or an explicitly supplied credential, leaving the default push key alone. |
| 79 | + # @returns [String | Nil] The API key used for this session. |
| 80 | + def api_key |
| 81 | + @api_key || ENV["GEM_HOST_API_KEY"] || (options[:key] && verify_api_key(options[:key])) |
| 82 | + end |
| 83 | + |
| 84 | + # Keep newly issued credentials in memory rather than changing the user's credentials file. |
| 85 | + # @parameter host [String] The authenticated RubyGems host. |
| 86 | + # @parameter key [String] The newly issued API key. |
| 87 | + def set_api_key(host, key) |
| 88 | + @api_key = key |
| 89 | + end |
| 90 | + |
| 91 | + private |
| 92 | + |
| 93 | + def get_mfa_params(profile) |
| 94 | + super.merge(expires_at: (Time.now.utc + 900).strftime("%Y-%m-%d %H:%M:%S UTC")) |
| 95 | + end |
| 96 | + |
| 97 | + def matching?(record) |
| 98 | + return false unless record.fetch("trusted_publisher_type") == TYPE |
| 99 | + settings = record.fetch("trusted_publisher") |
| 100 | + |
| 101 | + # Generated publishing workflows run in the configured repository, not a reusable workflow repository: |
| 102 | + @settings.all?{|key, value| settings[key] == value} && |
| 103 | + settings["workflow_repository_owner"].nil? && settings["workflow_repository_name"].nil? |
| 104 | + end |
| 105 | + |
| 106 | + def request(method, expected:, payload: nil) |
| 107 | + response = rubygems_api_request(method, @path, scope: SCOPE) do |request| |
| 108 | + request["Authorization"] = api_key |
| 109 | + request["Accept"] = "application/json" |
| 110 | + if payload |
| 111 | + request["Content-Type"] = "application/json" |
| 112 | + request.body = JSON.generate(payload) |
| 113 | + end |
| 114 | + end |
| 115 | + unless response.code == expected |
| 116 | + raise "RubyGems trusted publisher #{method.to_s.upcase} failed (HTTP #{response.code}): #{clean_text(response.body)}" |
| 117 | + end |
| 118 | + |
| 119 | + JSON.parse(response.body) |
| 120 | + end |
| 121 | + end |
| 122 | + end |
| 123 | + end |
| 124 | +end |
0 commit comments