[lloydwatkin]

Why

The publish workflow has never successfully released a gem. Only one run has ever fired — tag v8.0.1, 2026-06-19 — and it died in release:guard_clean:

janus-ar 8.0.0 built to pkg/janus-ar-8.0.0.gem.
rake aborted!
There are files that need to be committed first.
Tasks: TOP => release => release:guard_clean

8.0.1 was then published by hand three minutes later.

Two independent things dirtied the checkout:

1. Gemfile.lock records the gem's own version in its PATH section. It said janus-ar (8.0.0) while version.rb said 8.0.1, so bundle install in CI rewrote it. This would recur on every release, since the lock has to be bumped alongside version.rb.
2. bundler-cache: true writes vendor/bundle (not gitignored) and rewrites the tracked .bundle/config.

Separately, the v8.0.1 tag points at a commit where version.rb still said 8.0.0 — so even a clean tree would have published the wrong version.

Trusted publishing is already set up correctly. rubygems/configure-rubygems-credentials completed and exported the OIDC token in that run; the job only failed afterwards. No credential work is needed, and the unused RUBYGEMS_API_KEY repo secret (created 2024) can be deleted.

What changed

• .github/workflows/publish.yml — plain bundle install instead of bundler-cache so nothing is written into the working tree; ruby-version: '3.4' instead of ruby (was resolving to 4.0.5); fetch-depth: 0 so release:source_control_push sees the tag as already created; two guard steps that fail with a readable message on tag/version mismatch or a dirty tree, rather than the cryptic guard_clean error.
• bin/release.sh — was gem build && gem push, i.e. the manual path that bypassed CI entirely. Now validates the version, rewrites version.rb, regenerates Gemfile.lock, commits and tags — keeping the two in lockstep so cause Bump rake from 13.1.0 to 13.2.1 #1 can't come back.
• janus-ar.gemspec — the gem was shipping bin/release.sh as an installed executable onto users' PATH (spec.executables == ["release.sh"]). Now [], and spec.files drops bin/ spec/ assets/ gemfiles/ .github/ and dotfiles (28 files → 19).
• Gemfile — http://rubygems.org → https. Gemfile.lock resynced to 8.0.1.
• actions/checkout v4 → v7 (v4 runs on deprecated Node 20 — visible as a warning in the failed run) and dependabot now covers github-actions, which was bundler-only and let checkout fall three majors behind.
• .gitignore — /pkg/, /vendor/. README.md — release process documented.

Verification

• rubocop --parallel clean; all three YAML files parse.
• Both guard scripts exercised against matching and mismatching tags.
• bundle exec rake build produces janus-ar-8.0.1.gem; bundle install leaves the tree clean.
• bin/release.sh tested end-to-end in a scratch repo: rejects malformed versions, rejects existing tags, handles pre-release suffixes (8.2.0.rc1).
• rspec not run locally (needs MySQL with the replica/primary users) — CI covers it, and no library code is touched.

Note / open question

Nothing gates publishing on tests: CI runs on main and PRs but not on tag pushes, so publish.yml will ship a gem regardless of whether the suite is green at that commit. In practice tags are cut from an already-tested main. Happy to add an rspec step (plus the MySQL service block) to the publish job, or require the CI run on the tagged SHA to have passed, if you'd rather it were enforced.

Next release

bin/release.sh 8.0.2
git push origin HEAD --follow-tags

🤖 Generated with Claude Code