[rafaelfranca]

Changes

• Add id-token: write to the release job.
• Set the release job environment to release.
• Use the pinned rubygems/configure-rubygems-credentials action for OIDC authentication.
• Publish the existing gem after the GitHub asset upload.
• Replace the manual release instructions with the trusted publisher configuration.

Verification

• actionlint 1.7.7 passed for .github/workflows/release.yml.
• The pinned action completed an OIDC exchange with a local server.
• Ruby 2.7.3 executed the workflow's gem push command with the resulting token.
• The local server verified the authorization header and the exact release gem bytes.
• The check did not publish a gem to RubyGems.org.

Required setup

Before the next release, a gem owner must register a trusted publisher for ejson2env.

• Repository owner: Shopify
• Repository name: ejson2env
• Workflow filename: release.yml
• Environment: release

The workflow does not require a RubyGems API token in the repository secrets.

[shane-lawrence]

Thanks @rafaelfranca!