build: semi-automated release process by extern-c · Pull Request #80 · CycloneDX/cyclonedx-ruby-gem

extern-c · 2026-07-01T03:34:07Z

Description

Add a release workflow for RubyGems and GitHub Releases triggered by version tags (v*).

This PR resolves issue: #46.

The workflow consists of three jobs:

Test: runs the test suite using Ruby 3.3.
RubyGems Release: publishes the gem to RubyGems using trusted publishing.
GitHub Release: creates a GitHub Release with generated release notes.

The GitHub Release does not include a built gem package and is intended only for release metadata and assets.

Future Improvements

To keep this change focused, a few related enhancements are left for follow-up work:

Verify that the gem version matches the release tag before publishing.
Ensure the tagged commit is reachable from a protected release branch (e.g. main) before publishing to reduce the risk of releasing from an unreviewed commit outside the normal development workflow.
Generate and publish SHA hashes for release assets.
Document the release process (e.g. updating the gem version, creating and publishing a release tag, and publishing a release).

Release documentation will be added in a follow-up PR.

Testing

The workflow has been validated to the extent possible, but I was unable to perform an end-to-end test for the RubyGems publishing step because trusted publishing requires maintainer-controlled RubyGems and repository configuration.

A maintainer will need to:

Create and configure a release environment if one does not already exist.
Configure RubyGems trusted publishing for the repository/environment.
Perform a test release to verify that the trusted publishing configuration is set up correctly.

AI Tool Disclosure

My contribution does not include any AI-generated content
My contribution includes AI-generated content, as disclosed below:
- AI Tools: [e.g. GitHub CoPilot, ChatGPT, JetBrains Junie etc.]
- LLMs and versions: [e.g. GPT-4.1, Claude Haiku 4.5, Gemini 2.5 Pro etc.]
- Prompts: [Summarize the key prompts or instructions given to the AI tools]

Affirmation

My code follows the CONTRIBUTING.md guidelines

codacy-production · 2026-07-01T03:37:01Z

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer}
_{TIP This summary will be updated as you push new changes.}

Signed-off-by: Amauri Bizerra <10775696+extern-c@users.noreply.github.com>

jkowalleck

the release process looks very promising. 👍

Release documentation will be added in a follow-up PR.

Docs shall happen when changes happen.

Could you please add some docs how this all works and how it is triggered?
This might go here: CONTRIBUTING.md section "To release a new version".
You might want to remove the "Manual process" and add a "Semi-Automated process" or whatever sounds appropriate

please also add a description of the build changes to CHANGELOG.md

jkowalleck · 2026-07-03T07:07:40Z

+    needs: rubygems_release
+    environment: release
+    permissions:
+      contents: write


please add a comment why this permission is needed

Addressed in e3c2541. Thanks for the suggestion.

jkowalleck · 2026-07-03T07:08:03Z

+    timeout-minutes: 10
+    needs: test
+    permissions:
+      contents: write


please add comments why the permissions are needed

Addressed in 51b50f1. Thanks for the suggestion.

jkowalleck · 2026-07-03T07:19:58Z

+          persist-credentials: false
+      - name: Create GitHub Release
+        run: |
+          gh release create "${{ github.ref_name }}" \


Suggested change

gh release create "${{ github.ref_name }}" \

gh release create "$GITHUB_REF_NAME" \

see

Addressed in 2106cb1. Thanks for the suggestion.

jkowalleck · 2026-07-03T07:20:50Z

+        with:
+          persist-credentials: false
+      - name: Create GitHub Release
+        run: |


please rework this to

run: > gh release create ... --verify-tag ...

jkowalleck · 2026-07-03T07:21:38Z

+          ruby-version: ruby
+          bundler-cache: false
+      - name: "Push gem to RubyGems"
+        uses: rubygems/release-gem@6317d8d1f7e28c24d28f6eff169ea854948bd9f7 # v1.2.0


please add a comment with the action's URL for easier docks lookup when maintaining.

Addressed in da61dd3. Thanks for the suggestion.

jkowalleck · 2026-07-03T07:38:26Z

+        run: |
+          gh release create "${{ github.ref_name }}" \
+            --verify-tag \
+            --generate-notes


I'd love to see the "--prerelease" marker in case the tag looks like one.
This will be especially needed to test the release process before merging the PR.

Possible way to do this: similar to https://github.com/CycloneDX/cyclonedx-buildroot/blob/main/.github/workflows/release.yml

add a new job that determines whether this is a prerelease

do a pattern-math on the version string

set an output parameter properly

have the release process depend on the newly added job

when creating the GH release: reflect on the outcome and flag as prerelease if needed

Implemented in 9e50640.

jkowalleck · 2026-07-03T07:40:12Z

+
+on:
+  push:
+    tags: ["v*"]


maybe better go with

Suggested change

tags: ["v*"]

tags: ["v*.*.*"]

Addressed in 3e9e0ba. Thanks for the suggestion.

jkowalleck · 2026-07-03T07:43:25Z

+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - name: Create GitHub Release


could the release have the gem as a release asset?
It would be ideal to use the one produced in the rubygems_release job - you could use https://docs.github.com/en/actions/concepts/workflows-and-actions/workflow-artifacts to transfer a file from one job to the other. (artifact lifetime of 1 day should be enough)

Would you be okay with deferring this for now? I don't think it's necessary to include the built gem in the GitHub release since it'll already be published to RubyGems, and anyone can build it from the release assets. AFAIK, rubygems/release-gem does not produce a build artifact, so we'd need to add additional steps to build the gem and upload it separately.

Signed-off-by: Amauri Bizerra <10775696+extern-c@users.noreply.github.com>

extern-c force-pushed the ci-release branch 3 times, most recently from f94b6a6 to e19047f Compare July 1, 2026 03:44

Implement Release workflow

b22ec67

Signed-off-by: Amauri Bizerra <10775696+extern-c@users.noreply.github.com>

extern-c force-pushed the ci-release branch from e19047f to d51d86c Compare July 2, 2026 21:58

Implement rubygems_release CI job

90ac387

Signed-off-by: Amauri Bizerra <10775696+extern-c@users.noreply.github.com>

extern-c force-pushed the ci-release branch from d51d86c to 90ac387 Compare July 2, 2026 21:59

Bump actions/checkout from v6.0.2 to v7.0.0

4f806b7

Signed-off-by: Amauri Bizerra <10775696+extern-c@users.noreply.github.com>

extern-c marked this pull request as ready for review July 2, 2026 23:30

extern-c requested a review from a team as a code owner July 2, 2026 23:30

Bump ruby/setup-ruby GHA from v1.310.0 to v1.314.0

7ff9329

Signed-off-by: Amauri Bizerra <10775696+extern-c@users.noreply.github.com>

jkowalleck requested changes Jul 3, 2026

View reviewed changes

jkowalleck reviewed Jul 3, 2026

View reviewed changes

jkowalleck changed the title ~~Add release workflow~~ build: semi-automated release process Jul 3, 2026

jkowalleck added the chore label Jul 3, 2026

extern-c added 3 commits July 4, 2026 11:20

Replace github.ref_name with GITHUB_REF_NAME in release job

2106cb1

Signed-off-by: Amauri Bizerra <10775696+extern-c@users.noreply.github.com>

Trigger release workflow only on vMAJOR.MINOR.PATCH tags

3e9e0ba

Signed-off-by: Amauri Bizerra <10775696+extern-c@users.noreply.github.com>

Add comment explaining required permissions for GitHub Releases

e3c2541

Signed-off-by: Amauri Bizerra <10775696+extern-c@users.noreply.github.com>

extern-c force-pushed the ci-release branch from 1a53a95 to e3c2541 Compare July 4, 2026 14:51

extern-c added 3 commits July 4, 2026 19:17

Add comments explaining required permissions for RubyGems Releases

51b50f1

Signed-off-by: Amauri Bizerra <10775696+extern-c@users.noreply.github.com>

Add comment with rubygems/release-gem GHA project URL

da61dd3

Signed-off-by: Amauri Bizerra <10775696+extern-c@users.noreply.github.com>

Add support for creating GitHub pre-releases

9e50640

Signed-off-by: Amauri Bizerra <10775696+extern-c@users.noreply.github.com>

	gh release create "${{ github.ref_name }}" \
	gh release create "$GITHUB_REF_NAME" \

Uh oh!

Uh oh!

Conversation

extern-c commented Jul 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Future Improvements

Testing

AI Tool Disclosure

Affirmation

Uh oh!

codacy-production Bot commented Jul 1, 2026

Up to standards ✅

Uh oh!

jkowalleck left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

extern-c commented Jul 1, 2026 •

edited

Loading

jkowalleck left a comment •

edited

Loading